| शीर्षक | dibo-software diboot v3.8.0 Insecure Direct Object Reference |
|---|
| विवरण | The AI session endpoints have inconsistent authorization checks. The list API correctly restricts results to the current user by filtering on createBy, which confirms that AI sessions are meant to be private, user-owned objects. However, the detail, update, and delete APIs accept a caller-supplied session id and operate on it directly without verifying ownership.Because the underlying service methods resolve records by primary key only, any authenticated user who knows or can guess another user’s session ID can read, modify, or delete that session. |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1-q66DxWFxQNmYF-1lzkHOodibWmZlGA0/view?usp=sharing |
|---|
| उपयोगकर्ता | Stephen Lin (UID 98370) |
|---|
| सबमिशन | 01/07/2026 09:35 AM (3 महीनों पहले) |
|---|
| संयम | 31/08/2026 07:33 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397233 [dibo-software diboot 3.8.0 AI Session Endpoint /api/ai-session/ अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|