Se1En

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code. Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new `IMPORT ERRORS ALL` permission.

Sensitive information exposure occurs via the `editor assets()` function, which exposes the `uag insta linked accounts` option through the `uagb blocks info` object without performing a capability check. Authenticated attackers with Contributor-level access or higher can extract sensitive data, including raw Instagram Graph API access tokens configured by an administrator. This issue requires the Spectra Pro plugin to be active and have a linked Instagram account.

An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to enumerate sequential integer entry IDs using the `draft` parameter to read saved draft form data from other users, including names, email addresses, phone numbers, addresses, and free-form message content. This issue is only exploitable on forms where the Save and Continue feature is enabled.

An issue exists where the system fails to restrict the `group constrained` channel flag to public and private channels that support group synchronization. This allows a standard member of a group or direct message to remove all other participants from the conversation by interacting with the channel patch API endpoint.

An Insecure Direct Object Reference exists due to a mismatch between the object used for authorization and the object accessed in the `Optimize Rest Controller`'s `create item()`, `get item()`, `delete item()`, and `bulk delete items()` endpoints. While authorization is verified using `current user can('edit post'/'delete post', $post id)` against the `post id` parameter, the storage layer retrieves records based on a SHA256 hash of the `post path` parameter. Because there is no enforcement ensuring that `post path` corresponds to the `post id`, authenticated attackers with Contributor-level access or higher can read or delete optimizer analysis records of posts owned by other users by providing their own `post id` and the victim's `post path`.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can bypass the `upload files` capability boundary to create arbitrary Media Library attachments. This is achieved by downloading remote images to the site's uploads directory using the `wp upload bits()` and `wp insert attachment()` functions.

An issue exists where the system fails to enforce the `PostEditTimeLimit` on non-message post fields. This allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired by using the post patch and update API endpoints.

A time-of-create-to-time-of-use (TOCTOU) issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to the data source before initial deletion, all steps completed within 30 seconds on the same Grafana pod, recreation of the data source by another user, the new data source having the same UID as the previous one, and the attacker not being an admin of the new data source.

The dashboard permissions API does not verify the target dashboard scope, only checking the `dashboards.permissions:*` action. This allows a user with permission management rights on one dashboard to read and modify permissions on other dashboards, resulting in a privilege escalation. The API endpoint in question is the dashboard permissions API. The vulnerable action is `dashboards.permissions:*`.