| शीर्षक | GitHub OpnForm 1.9.3 Improper Access Controls |
|---|
| विवरण | Title: Broken Function Level Authorization on the /custom-domains API Endpoint
Description: A low privileged user with read-only restrictions is able to modify the custom domain of an OpnForm instance. This action is normally invisible to a user with these privileges.
The vulnerability has confirmed by the vendor to have been patched in v1.9.3 main branch with commit beb153ce52dceb971c1518f98333328c95f1ba20.
Please see the attached Google Doc link for more information under 5. Broken Function Level Authorization on the /custom-domains API Endpoint and the Response from the Vendor section for more detail.
Vulnerable version: https://github.com/JhumanJ/OpnForm/tree/v1.9.3
Patched Commit: https://github.com/JhumanJ/OpnForm/pull/900/commits/beb153ce52dceb971c1518f98333328c95f1ba20 |
|---|
| स्रोत | ⚠️ https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.gm61tyll8uys |
|---|
| उपयोगकर्ता | balejin (UID 89385) |
|---|
| सबमिशन | 01/10/2025 09:00 PM (1 वर्ष पहले) |
|---|
| संयम | 07/10/2025 03:17 PM (6 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 327375 [JhumanJ OpnForm तक 1.9.3 API Endpoint /custom-domains अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|