Shivarajrn

A server-side request forgery issue exists in the Azure wodle `get graph events()` function. The function follows the `@odata.nextLink` variable without performing host or HTTPS validation. This allows attackers who can influence the `@odata.nextLink` value to redirect manager requests to endpoints under their control, enabling the capture of the reused Microsoft Graph bearer token and access to internal services.

A server-side request forgery (SSRF) issue exists in the GitHub module (wm github.c). The system trusts unvalidated Link rel="next" pagination URLs, allowing an attacker who controls the next-page URL to force the manager to send requests containing the GitHub API token to external hosts. This can lead to the exposure of organization repositories and settings.

Authenticated dashboard users can bypass authorization by overriding the Manager API Authorization header through the '/api/request' proxy endpoint. By providing nested `body.headers.Authorization` values, an attacker can replace the server-side session Bearer token, enabling them to impersonate another Manager API identity or transmit unauthenticated upstream requests.