| タイトル | David-Crty Databasement >= 1.2.0, < 1.7.2 Improper Access Controls |
|---|
| 説明 | An insecure direct object reference (IDOR) vulnerability was identified in the Snapshot model of Databasement, an open-source Laravel-based database backup management platform. The application implements multi-tenant isolation through a global OrganizationScope applied to models like DatabaseServer and Volume. However, the Snapshot model does not register this global scope in its booted() method, despite having the OrganizationScope import present in the file. As a result, the API endpoints GET /api/v1/snapshots and GET /api/v1/snapshots/{id} return snapshots from all organizations without any tenant filtering. Any authenticated user — regardless of role or organization membership — can enumerate, read, download, restore, and delete backup snapshots belonging to every organization in the system. The SnapshotPolicy methods viewAny() and view() return true unconditionally, providing no compensating authorization check. The Livewire (web UI) path correctly applies forCurrentOrg() scoping, but the API path does not, creating an inconsistent authorization boundary. This enables full cross-tenant data exfiltration of database backups containing PII, credentials, and sensitive business data. Patched in version 1.7.2 by adding the OrganizationScope global scope to the Snapshot model. |
|---|
| ソース | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv |
|---|
| ユーザー | ByteJMP (UID 99294) |
|---|
| 送信 | 2026年09月03日 04:41 (29 日 ago) |
|---|
| モデレーション | 2026年09月30日 21:07 (28 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 412346 [David-Crty databasement 迄 1.7.1 Snapshot Model /api/v1/snapshots SnapshotPolicy.viewAny/SnapshotPolicy.view 特権昇格] |
|---|
| ポイント | 20 |
|---|