| عنوان | dibo-software diboot v3.8.0 Broken Access Control |
|---|
| الوصف | The tenant administrator management API allows any authenticated user to query and modify another tenant's admin account by supplying a tenantId. Because the controller and service only trust the externally provided tenantId and do not verify the caller's ownership or management permission, an attacker can overwrite tenant admin credentials, realname, status, and account binding information for arbitrary tenants. |
|---|
| المصدر | ⚠️ https://drive.google.com/file/d/1D9XNhOV7wkc4dl2M59hTML0pmVF9irbi/view?usp=sharing |
|---|
| المستخدم | Stephen Lin (UID 98370) |
|---|
| ارسال | 01/07/2026 09:37 AM (2 أشهر منذ) |
|---|
| الاعتدال | 31/08/2026 07:33 AM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 397234 [dibo-software diboot 3.8.0 Tenant Administrator Management API /admin/ tenantId تجاوز الصلاحيات] |
|---|
| النقاط | 19 |
|---|