Santoshkumarpuppala

Authenticated users with U/user, D/domain-admin, or H/host roles can release or permanently delete quarantined emails belonging to other users or domains. This occurs because the endpoint 'mailscanner/quarantine action.php' calls the `quarantine list items()` function in 'mailscanner/functions.php', which retrieves data from the `maillog` using a supplied `id` without applying the required per-role `global filter`. Since message identifiers are enumerable and ownership is not verified, a low-privilege user can trigger the `quarantine release()` or `quarantine delete()` functions for messages they do not own.

Guest users can approve or reject quotes belonging to any client regardless of their assignment. In the Guest Quotes controller located at `application/modules/guest/controllers/Quotes.php`, the `approve()` and `reject()` methods call `approve quote by id($quote id)` and `reject quote by id($quote id)` without implementing the necessary client scoping. This allows a guest user to modify the status of another client's quote by providing sequential integer `quote id` values, which also triggers notification emails via `email quote status()`. Furthermore, the `generate pdf()` function calls `mark viewed($quote id)` before verifying the client scope, enabling guest users to mark quotes from other clients as viewed.

The `udevices` JSON command handler, `Cmd UpdateDevices` in `main/WebServerCmds.cpp`, fails to perform a `session.rights` check before invoking a Lua parser script. A low-privilege authenticated user can trigger the execution of an existing operator-installed Lua parser script using attacker-controlled input via the `GET /json.htm` endpoint with `type=command` and `param=udevices`. Additionally, the `script` parameter lacks a path-traversal guard in `CLuaHandler::executeLuaScript` within `main/LuaHandler.cpp`, which constructs the filename from the parser directory and the supplied script name before passing it to `luaL loadfile`. Execution is limited to previously installed valid Lua files.

An issue exists where a non-superuser API token with read access to a single ObjectType can access the full versioned record of objects belonging to any other ObjectType. This occurs via the `GET /api/v2/objects/{uuid}/{index}` endpoint. The `history detail` action in `src/objects/api/v2/views.py` bypasses necessary permission checks by calling `self.get queryset()` and `get object or 404` instead of `self.get object()`, which prevents the execution of `check object permissions` and the `ObjectTypeBasedPermission.has object permission` check. Consequently, the `data` of versioned objects, potentially including sensitive citizen or case records, can be disclosed.

Certain endpoints fail to enforce proper permission checks. This allows authenticated users to access and read financial data that exceeds the permissions granted to their assigned role.

Staff users assigned the Editor or Super Editor roles can assign their own role to users with Author or Contributor roles, bypassing the intended permission restrictions.

Ghost fails to correctly restrict staff role assignment. This allows authenticated users with the Editor or Super Editor role to assign their own role to other staff members, even though they lack the necessary permissions. Consequently, an Editor or Super Editor can promote users with Author or Contributor roles to Editor or Super Editor status.

An SQL injection issue exists in the analytics filter builder due to insufficient validation of `profile.*` filter column identifiers before they are interpolated into ClickHouse WHERE clauses. An authenticated attacker possessing project-scoped read or root export credentials can execute arbitrary ClickHouse SQL. This allows the attacker to bypass project isolation and access analytics data and profile PII (Personally Identifiable Information) from other organizations using blind boolean oracle techniques, a method of extracting data by asking the database true/false questions based on the application's response.

The `index.js` file fails to normalize the `options.fileName` variable using `path.basename()` when constructing a filesystem path via `path.join(tempDir.name, fileName)`. This allows a caller to provide a filename containing path traversal sequences like `../`, enabling the writing of a document buffer to arbitrary paths writable by the process, such as SSH `authorized keys` files, cron configurations, or web roots.