| शीर्षक | dibo-software diboot v3.8.0 Broken Access Control |
|---|
| विवरण | The tenant resource assignment endpoints expose a tenant-scoped Broken Access Control issue. The controller accepts a caller-supplied tenantId directly in both the read and write routes,then forwards it to the service layer without checking whether the authenticated user actually owns that tenant or has any management authority over it. In GET /api/iam/tenant/resource/{tenantId}, the API returns the tenant’s current resource IDs by querying only on tenantId. In POST /api/iam/tenant/resource/{tenantId}, the API rewrites the many-to-many tenant-resource mapping by passing the same tenantId and attacker-controlled ids list into the relation update helper. Because there is no object-level permission check and no tenant boundary validation, any authenticated user who knows or guesses a valid tenantId can enumerate that tenant’s authorization set and arbitrarily grant or revoke permissions. |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1qFtwq78JN5Af3GlSD2utfQIbOPBaaQ47/view?usp=sharing |
|---|
| उपयोगकर्ता | Stephen Lin (UID 98370) |
|---|
| सबमिशन | 01/07/2026 09:41 AM (2 महीनों पहले) |
|---|
| संयम | 31/08/2026 07:33 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397235 [dibo-software diboot 3.8.0 Tenant Resource Assignment /api/iam/tenant/resource tenantId अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|