Ya3Raj

A missing authentication issue exists in the aggregated meta info route of `utils.controller.ts`. This allows unauthenticated attackers to access instance-wide metadata by requesting the endpoint. Exposed information includes the enumeration of bases, user counts, counts of shared and password-protected views, webhook counts, and live per-base row counts. Additionally, repeated requests to this endpoint can increase the database query load.

The `get-comment-threads`, `get-comment-thread`, and `get-comments` RPC commands use the `check-comment-permissions!` function but fail to apply restrictions related to page-scoped share links. This allows a user with a page-scoped share link to retrieve comment threads and full comment bodies from other pages within the same file. The exposed information includes commenter names, email addresses, photos, and page identifiers. Furthermore, these page identifiers can be used with page-reading functionality to access design content that has not been shared.

An issue exists in the `delete-team-member` RPC where a team administrator can remove any member except themselves, but the system fails to protect the team owner. This allows a non-owner administrator to delete the owner's `team-profile-rel` membership, effectively locking the owner out of the team and all associated projects, files, fonts, and media.

Insufficient HTML-escaping of the `employee num` field in the acceptance PDF generator allows users with `users.edit` permissions to inject `img` tags into the `writeHTML()` function of TCPDF. This can be exploited to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance. This issue leads to Server-Side Request Forgery (SSRF), a condition where the server is coerced into making requests to an unintended location.

A stored cross-site scripting issue exists in the `formattedNameLink()` function within `DepartmentPresenter`. This occurs because department names are rendered without proper escaping in the fallback branch for users lacking the `departments.view` permission. An attacker with `departments.edit` permission can inject malicious scripts into department names, which then execute in the browsers of all department members when they access the My Assets page.