github - ghsa-8p2f-fx4q-75cx

GHSA-8P2F-FX4Q-75CX

Vulnerability from github – Published: 2025-08-22 16:49 – Updated: 2025-08-22 21:08

Summary

UnoPim has Broken Access Control

Details

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.3.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "unopim/unopim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-55741"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-22T16:49:55Z",
    "nvd_published_at": "2025-08-22T16:15:46Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nIn Unopim, it is possible to create roles and choose the privileges. However, users without the \u201cDelete\u201d privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.\n\n**Severity**:\u00a0High CVSS Score 8.1 (CVSS 3.1 Vector:\u00a0[AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\u0026version=3.1))\n**Category**: Broken Access Control / Missing Authorization (OWASP A01:2021)\n**Impact**: Unauthorized product deletion -\u003e data loss, possible business disruption\n\n### Affected Behavior\n**Single delete (enforced):**\n**DELETE** `/admin/catalog/products/{id}` returns 401 with \"This action is unauthorized\" for users lacking the Delete privilege.\n\n**Mass delete (not enforced):**\n**POST** `/admin/catalog/products/mass-delete` allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.\n\n### PoC\nA video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.\n\n### Impact\nUnauthorized product deletion -\u003e data loss, possible business disruption",
  "id": "GHSA-8p2f-fx4q-75cx",
  "modified": "2025-08-22T21:08:49Z",
  "published": "2025-08-22T16:49:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55741"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unopim/unopim/commit/f49fa630afd36ff61c146b3e5bc7a0808667ca19"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/unopim/unopim"
    },
    {
      "type": "WEB",
      "url": "https://www.youtube.com/watch?v=J_WV8fCXlJM"
    },
    {
      "type": "WEB",
      "url": "https://youtu.be/J_WV8fCXlJM"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "UnoPim has Broken Access Control"
}

CVE-2025-55741 (GCVE-0-2025-55741)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:04 – Updated: 2025-08-22 16:24

Title

unopim/unopim allows unauthorized product deletion via mass-delete endpoint

Summary

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE

CWE-284 - Improper Access Control
CWE-862 - Missing Authorization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/unopim/unopim/security/advisor…	x_refsource_CONFIRM
	https://github.com/unopim/unopim/commit/c14eebe65…	x_refsource_MISC
	https://www.youtube.com/watch?v=J_WV8fCXlJM	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	unopim	unopim	Affected: < 0.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55741",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-22T16:24:44.604860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-22T16:24:48.523Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.youtube.com/watch?v=J_WV8fCXlJM"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "unopim",
          "vendor": "unopim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-22T16:04:51.542Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx"
        },
        {
          "name": "https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989"
        },
        {
          "name": "https://www.youtube.com/watch?v=J_WV8fCXlJM",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.youtube.com/watch?v=J_WV8fCXlJM"
        }
      ],
      "source": {
        "advisory": "GHSA-8p2f-fx4q-75cx",
        "discovery": "UNKNOWN"
      },
      "title": "unopim/unopim allows unauthorized product deletion via mass-delete endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55741",
    "datePublished": "2025-08-22T16:04:51.542Z",
    "dateReserved": "2025-08-14T22:31:17.684Z",
    "dateUpdated": "2025-08-22T16:24:48.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-8P2F-FX4Q-75CX

Summary

Affected Behavior

PoC

Impact

CVE-2025-55741 (GCVE-0-2025-55741)

Tags

Sightings

Nomenclature