Sanjok Karki

In SQL Server deployments, the stored procedure `User ReadBySsoUserOrganizationIdExternalId()` declares the `@ExternalId` parameter as NVARCHAR(50), whereas the queried column uses NVARCHAR(300). This discrepancy causes the SSO login identifier to be silently truncated. Consequently, a user whose identity-provider identifier starts with the full 50-character identifier of another organization member can authenticate as that member and obtain a victim-scoped access token.

An issue exists where the server fails to verify if the caller is a member of the organization specified in the request body of the 'POST /collect' endpoint. This allows any authenticated user to inject forged entries with arbitrary backdates into the audit log of any organization.

An issue exists where the server fails to verify if the email address provided in the body of the 'POST /auth-requests/admin-request' endpoint belongs to the authenticated user. This allows a low-privileged organization member to initiate a Trusted Device Encryption authentication request bound to a public key controlled by the attacker. Once approved, the request becomes readable from an unauthenticated endpoint, enabling the attacker to obtain another user's vault key and a victim-scoped access token, leading to account takeover and disclosure of the vault key.

An issue exists where authenticated Custom users with the `ManageUsers` permission can escalate privileges to remove Admin accounts from an organization. This occurs due to a missing role hierarchy check in the bulk user-remove endpoint. By supplying Admin organization-user IDs in a bulk DELETE request, an attacker can bypass the security guards present in the single-user removal path.

Broken access control allows any authenticated user to access arbitrary organization billing data. By supplying an arbitrary `organizationId` to the `PreviewInvoiceController` endpoints, an attacker can bypass membership and authorization checks due to a missing `ManageOrganizationBillingRequirement`. This allows the retrieval of subscription status, Stripe-computed tax totals, and billing details derived from a target organization's customer and subscription data.

An issue exists in the `IntegrationTemplateProcessor.ReplaceTokens()` function where user-controlled values are substituted into event-integration templates without proper JSON encoding. An authenticated member can exploit this by setting their display name to include JSON metacharacters. This allows the injection of arbitrary key-value pairs into rendered payloads sent to webhook, SIEM, Slack, Teams, or Datadog endpoints. The injected fields are indistinguishable from legitimate template output when tokens such as `#ActingUserName#` or `#UserName#` are used.

A missing authorization issue allows a provider service user to add an arbitrary organization to their provider. This is possible through the 'POST /providers/{providerId}/clients/existing' endpoint, where the `providerId` variable is used. Successful exploitation can result in the takeover of the target organization. This issue specifically affects Cloud installations, as the endpoint is restricted and not available in self-hosted environments.

A missing authorization issue allows any authenticated user to write ciphers into an arbitrary organization. This occurs when submitting an empty `collections` array to the 'POST /ciphers/import-organization' endpoint, which causes the server-side permission check to be skipped.

An issue exists where master-password re-authentication is not required when retrieving or rotating an organization's SCIM API key. This allows an authenticated user with SCIM management privileges to obtain the key using only a valid session.

The issue allows unauthorized access to the WAN configuration page "wan.htm" without authentication, potentially disclosing WAN settings information and enabling attackers to modify data fields on the page.