Vectrain51

A race condition exists in the `plugin/PayPalYPT/ipn.php` file. This occurs because the deduplication check and insert process is non-atomic, allowing attackers to bypass Instant Payment Notification (IPN) replay protection. By concurrently replaying a captured valid recurring-payment notification, multiple requests can pass the `isRecurringPaymentIdUsed()` function, enabling the attacker to obtain duplicate subscription renewals and wallet credits.

The Twig content sandbox fails to restrict dump and serialize filters, specifically `print r`, `vardump`, `json encode`, `yaml encode`, and `string`. This occurs because the `GravExtension::assertSandboxDumpSafe()` function calls `SandboxExtension::isSandboxed()` without a `Source` argument, which only reports a global sandbox flag that is never enabled. Consequently, an authenticated user with page-edit rights can use Twig processing in page content to dump the entire merged configuration. This bypasses path redaction in the `SandboxConfig` facade and exposes sensitive plugin secrets, including SMTP credentials, API tokens, webhook secrets, and cache backend passwords.

An incorrect authorization flaw exists in the `update()` function within `app/Http/Controllers/Users/UsersController`. The single-user edit route assigns the `activated` field from the request payload before evaluating the `canEditAuthFields` authorization gate. This allows an authenticated non-admin user with the `users.edit` permission in the target's company scope to send a PUT request to the '/users/{id}' endpoint and toggle the `activated` flag for any user, including admin and superuser accounts. Deactivating an admin account results in that account being locked out of the application. Only the `activated` field is affected; other sensitive data and the API are not impacted.

Insufficient validation of backup profile root paths allows users with profile editor access to archive directories outside the `GRAV ROOT` directory, provided the paths are not included in the hard-coded deny-list. This can be exploited using traversal paths to expose sensitive files from system locations such as /opt, /mnt, or /srv.

When the `qs.parse` function is used with the `comma` and `throwOnLimitExceeded` options set to `true`, a comma-separated value assigned to a bracket-push key (e.g., `a[]=1,2,3,4`) is split into an array without being validated against the `arrayLimit`. In contrast, the same value assigned to flat, indexed, nested, or dotted keys correctly triggers a `RangeError`. This occurs because the `arrayLimit` check in `lib/parse.js` was applied after the value was wrapped as a nested element, and a subsequent attempt to fix this using an `isFlatArrayValue` flag failed to account for the `[]=` key form. An unauthenticated attacker can exploit this by providing a single `a[]=` parameter to bypass configured limits and force the parser to allocate an array proportional to the request size, potentially leading to excessive memory consumption.