Tienner

A user possessing `users.edit` and API permissions can escalate their privileges by sending a PATCH request to the '/api/v1/users/{their own id}' endpoint. This allows the user to grant themselves various permissions, such as `assets.view`, `assets.create`, `reports.view`, and import capabilities, although they cannot grant themselves admin or superuser status.

The log export functionality is susceptible to CSV Injection (Formula Injection), which occurs when user-controlled data is written to exported CSV files without sanitizing formula trigger characters such as `=`, `+`, `-`, and `@`. Specifically, the `username` field is written verbatim to the output. When an administrator opens the resulting CSV file in spreadsheet applications like Microsoft Excel, LibreOffice Calc, or Google Sheets, any formula stored in a username is executed. This can facilitate phishing attacks against administrators or lead to data exfiltration using functions like `=IMPORTXML()`. The issue exists in the following controllers: - `lib/Application/Controller/ListLogUsersController.php` - `lib/Application/Controller/ListLogZonesController.php` - `lib/Application/Controller/ListLogGroupsController.php` - `lib/Application/Controller/ListLogApiController.php` Additionally, PHP deprecation warnings may be emitted into the HTTP response body, exposing internal file paths.