| शीर्षक | CodeGenieApp @codegenie/serverless-express <=4.17.1 Broken Object Level Authorization |
|---|
| विवरण | The TodoList management system contains a critical Broken Object Level Authorization (BOLA) vulnerability (also known as IDOR) due to a missing ownership model in the database schema. The TodoList DynamoDB table lacks a userId field, preventing any ownership association between lists and their creators. Consequently, if an attacker obtains a valid listId (e.g., via leaked URLs, Referer headers, or chained with the previously reported Property Injection vulnerability), they can use their own authenticated session to view, modify, or permanently delete any other user's todo lists, resulting in a complete compromise of data confidentiality, integrity, and availability. |
|---|
| स्रोत | ⚠️ https://github.com/AnalogyC0de/public_exp/issues/20 |
|---|
| उपयोगकर्ता | Ana10gy (UID 93358) |
|---|
| सबमिशन | 02/03/2026 04:00 AM (7 महीनों पहले) |
|---|
| संयम | 14/03/2026 01:57 PM (12 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 351078 [CodeGenieApp serverless-express तक 4.17.1 API Endpoint TodoList.ts userId अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|