Sardor Shoakbarov

**Name of the Vulnerable Software and Affected Versions** Aerie/PlanDev sequencing-server (affected versions not specified) **Description** The authorization middleware in `sequencing-server/src/app.ts` uses the `getHasuraSession()` function to determine the caller's session role. This function prioritizes the `session variables` object provided in the client's JSON request body over the JWT claims in the Authorization header, without verifying if the request originated from Hasura. An unauthenticated attacker can bypass role checks by including `{"session variables":{"x-hasura-role":"aerie admin"}}` in the request body to the 'POST /command-expansion/put-expansion' endpoint, allowing the insertion of arbitrary expansion rules into `sequencing.expansion rule`. Additionally, the 'POST /put-dictionary' endpoint is included in the `ENDPOINTS WHITELIST` and does not require authentication, enabling unauthenticated writes to command dictionaries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.