| عنوان | MODSetter SurfSense <=0.0.36 Missing Authorization |
|---|
| الوصف | SurfSense 0.0.36 accepts unauthenticated HTTP requests on the Circleback meeting webhook. The workspace identifier in the URL is a sequential integer and is not bound to a shared secret or user session. A remote attacker who can reach the API can create or overwrite meeting documents in any workspace knowledge base. No Circleback connector, account, or victim interaction is required. Injected content is stored, embedded, and later used by search and chat. |
|---|
| المصدر | ⚠️ https://gist.github.com/DReazer/1e476832e48bcdb2b4f732689dfeac0c |
|---|
| المستخدم | Snkn0w (UID 90071) |
|---|
| ارسال | 17/08/2026 05:43 AM (2 أشهر منذ) |
|---|
| الاعتدال | 28/09/2026 08:46 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 411143 [MODSetter SurfSense حتى 2.0.3 circleback Endpoint circleback_webhook_route.py توثيق ضعيف] |
|---|
| النقاط | 20 |
|---|