Skip to content

Commit e334677

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-8cw6-53m5-4932 GHSA-w5wv-wvrp-v5m5
1 parent 002aeac commit e334677

File tree

2 files changed

+173
-0
lines changed

2 files changed

+173
-0
lines changed

‎advisories/github-reviewed/2026/01/GHSA-8cw6-53m5-4932/GHSA-8cw6-53m5-4932.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8cw6-53m5-4932",
4+
"modified": "2026-01-27T22:13:52Z",
5+
"published": "2026-01-27T22:13:52Z",
6+
"aliases": [
7+
"CVE-2026-24134"
8+
],
9+
"summary": "StudioCMS has Authorization Bypass Through User-Controlled Key",
10+
"details": "### Summary\nStudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the \"Visitor\" role to access draft content created by Editor/Admin/Owner users.\n\n### Details\n**The Issue:**\nThe endpoint `/dashboard/content-management/edit?edit={UUID}` validates user authentication but does NOT validate:\n1. User role (should require Editor/Admin/Owner)\n2. Content ownership (should verify the draft belongs to the user)\n\nThis allows users with \"Visitor\" role (lowest privilege) to access draft content created by Editor/Admin/Owner users by directly accessing the edit URL with the content UUID.\n\n### PoC\n - **User A:** Editor role (example username: `dummy04`)\n - **User B:** Visitor role (example username: `dummy01`)\n\n**Reproduction Steps:**\n\n**Step 1 - Create draft as Editor:**\n\n1. Login as User A (Editor role)\n2. Navigate to: `http://localhost:4321/dashboard/content-management`\n3. Create new content (it will stay as draft)\n4. After saving, note the UUID in the URL:\n````\n http://localhost:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148\n````\n Copy this UUID: `bad87630-69a4-4cd6-bcb2-6965839dc148`\n\n**Step 2 - Access draft as Visitor:**\n\n1. Login as Visitor and get auth_session cookie\n```\ncurl -X POST \"http://127.0.0.1:4321/studiocms_api/auth/login\" -F 'username=dummy01' -F 'password=dummy01pass$'\n```\n<img width=\"1128\" height=\"376\" alt=\"01\" src=\"https://github.com/user-attachments/assets/86c5290e-e7a2-470e-bbf5-5f5247eddec1\" />\n\n2. Proof of Visitor permission\n<img width=\"1899\" height=\"450\" alt=\"02\" src=\"https://github.com/user-attachments/assets/aabd47d3-163f-4a56-8296-08bd40c5ccdc\" />\n\n3. Access Editor's draft using the UUID\n```\ncurl \"http://127.0.0.1:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148\" -H \"Cookie: auth_session=qvawh6zv23hc2spu6xx7pzgrnn4rpd3q\" -v\n```\n\n**Result:** Returns full HTML page with draft content (200 OK)\n\n### Impact\n**Impact Scenarios:**\n\n1. **Information Disclosure:**\n - Visitor users can read unpublished drafts containing sensitive information\n - Drafts may contain confidential business information, unreleased announcements, or proprietary content\n - Competitive intelligence could be gathered from draft content\n\n2. **Privacy Violation:**\n - Personal notes, work-in-progress content, or internal communications in drafts exposed\n - Violation of content creator privacy expectations\n\n3. **Business Impact:**\n - Premature disclosure of marketing campaigns, product launches, or announcements\n - Loss of competitive advantage if draft strategies are exposed\n - Potential compliance issues if drafts contain regulated information\n\n4. **Complete RBAC Bypass:**\n - The entire role-based access control system for draft content is bypassed\n - \"Visitor\" role becomes equivalent to \"Editor\" for read access to drafts\n - Undermines the trust model of multi-user content management",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "studiocms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.2.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/withstudiocms/studiocms"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-639",
59+
"CWE-862"
60+
],
61+
"severity": "MODERATE",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-01-27T22:13:52Z",
64+
"nvd_published_at": null
65+
}
66+
}

‎advisories/github-reviewed/2026/01/GHSA-w5wv-wvrp-v5m5/GHSA-w5wv-wvrp-v5m5.json‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w5wv-wvrp-v5m5",
4+
"modified": "2026-01-27T22:15:28Z",
5+
"published": "2026-01-27T22:15:28Z",
6+
"aliases": [
7+
"CVE-2026-24748"
8+
],
9+
"summary": "Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access",
10+
"details": "### Impact\n\nA bug was found with authentication checks on the `GetConfig()` API endpoint. This allowed unauthenticated users to access this endpoint by specifying an `Authorization` header with any non-empty `Bearer` token value, regardless of validity. This vulnerability did allow for exfiltration of configuration data such as endpoints for connected Argo CD clusters. This data could allow an attacker to enumerate cluster URLs and namespaces for use in subsequent attacks.\n\nAdditionally, the same bug affected the `RefreshResource` endpoint. This endpoint does not lead to any information disclosure, but could be used by an unauthenticated attacker to perform a denial-of-service style attack against the Kargo API. `RefreshResource` sets an annotation on specific Kubernetes resources to trigger reconciliations. If run on a constant loop, this could also slow down legitimate requests to the Kubernetes API server.\n\nThis vulnerability was identified by security researchers, and there are no known reports of exploitation in the wild.\n\n### Patches\n\nThis problem has been patched in the previous 3 versions of Kargo. Based on our information, almost all users are on one of these versions. If for some reason you cannot upgrade from an earlier version, please reach out to us.\n\n### Workarounds\n\nThere are no workarounds for this issue, so it is highly recommended to upgrade at the earliest possible\n\n### Additional details\n\nThis issue was caused by fallback logic in token authentication. The majority of Kargo endpoints are backed by Kubernetes objects, and for these endpoints, unrecognized token types are passed to the Kubernetes API for validation. However, the affected endpoints do not use Kubernetes or used an internal client not subject to authentication, so unrecognized tokens had no validation fallback. As a result, any request with a non-empty `Bearer` token in the `Authorization` header was incorrectly treated as authorized.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/akuity/kargo"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.6.3"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/akuity/kargo"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "1.7.0-rc.1"
48+
},
49+
{
50+
"fixed": "1.7.7"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/akuity/kargo"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "1.8.0-rc.1"
67+
},
68+
{
69+
"fixed": "1.8.7"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/akuity/kargo/security/advisories/GHSA-w5wv-wvrp-v5m5"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/akuity/kargo/commit/23646eaefb449a6cc2e76a8033e8a57f71369772"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/akuity/kargo/commit/aa28f81ac15ad871c6eba329fc2f0417a08c39d7"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/akuity/kargo/commit/b3297ace0d3b9e7f7128858c5c4288d77f072b8c"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/akuity/kargo"
96+
}
97+
],
98+
"database_specific": {
99+
"cwe_ids": [
100+
"CWE-863"
101+
],
102+
"severity": "MODERATE",
103+
"github_reviewed": true,
104+
"github_reviewed_at": "2026-01-27T22:15:28Z",
105+
"nvd_published_at": null
106+
}
107+
}

0 commit comments

Comments
 (0)