Name of the Vulnerable Software and Affected Versions Saltcorn versions prior to 0.8.7

Description The issue allows an untrusted user with admin rights to a tenant instance to install a plugin that can access information from other tenants, potentially compromising all tenants of the installation. This can be achieved by publishing an unapproved plugin to NPM and then installing it in a tenant. The vulnerability is not fully fixed in version 0.8.7. The estimated number of potentially affected devices is not specified.

Recommendations For Saltcorn versions prior to 0.8.7, consider disabling the plugin installation feature for tenants until a patch is available. Restrict access to the available plugins configuration to prevent tenant admins from installing unsafe plugins. As a temporary workaround, manually review and approve all plugins before they are installed in any tenant instance. At the moment, there is no information about a newer version that contains a fix for this vulnerability.