Robert Mihaila

Incomplete Comparison with Missing Factors (CWE-1023) in merge chats() (whatstk/utils/chat merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of merge two chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.

Missing authentication in the product cache revalidation Server Action allows a remote, unauthenticated attacker to force the expiration of the entire storefront product cache. The function `revalidateProducts()` in `src/app/actions.ts` calls `updateTag("products")` without performing session or role checks. Because the file uses the "use server" directive, the function is compiled into a POST-invokable Server Action. The action ID is exposed in a public `/ next/static` chunk, which is not protected by the admin middleware in `proxy.ts`. When `cacheComponents` is enabled, the storefront relies on cached entries from `getAllProducts()`, `getCategoryProducts()`, and `getProduct()`. Repeatedly invoking the vulnerable action keeps the cache cold, forcing the application to read the full product catalog from the Postgres database for every request, which degrades storefront availability.

The email module contains a stored cross-site scripting issue. A remote, authenticated user with low privileges can execute arbitrary JavaScript in the browser of another user, including administrators, by storing a malicious payload in an email body. This occurs because the email body is persisted without sanitization and rendered unescaped using `{!! $email->body !!}` when the recipient opens the message, which can lead to session compromise and account takeover.

An authorization bypass exists in the `CalendarDeleteEventController` (app/Http/Controllers/Calendar/CalendarDeleteEventController.php) via the GET '/calendar/event/delete/{id}' endpoint. A remote, authenticated attacker can delete arbitrary calendar events belonging to other users by manipulating the `{id}` path parameter. This occurs because the delete handler uses the `Calendar::find($id)->delete()` function without performing ownership checks, such as scoping by `user id` or `company id`, leading to unauthorized destruction of data across the platform.