| 제목 | David-Crty Databasement >= 1.2.0, < 1.7.2 Improper Access Controls |
|---|
| 설명 | An insecure direct object reference (IDOR) vulnerability was identified in the Snapshot model of Databasement, an open-source Laravel-based database backup management platform. The application implements multi-tenant isolation through a global OrganizationScope applied to models like DatabaseServer and Volume. However, the Snapshot model does not register this global scope in its booted() method, despite having the OrganizationScope import present in the file. As a result, the API endpoints GET /api/v1/snapshots and GET /api/v1/snapshots/{id} return snapshots from all organizations without any tenant filtering. Any authenticated user — regardless of role or organization membership — can enumerate, read, download, restore, and delete backup snapshots belonging to every organization in the system. The SnapshotPolicy methods viewAny() and view() return true unconditionally, providing no compensating authorization check. The Livewire (web UI) path correctly applies forCurrentOrg() scoping, but the API path does not, creating an inconsistent authorization boundary. This enables full cross-tenant data exfiltration of database backups containing PII, credentials, and sensitive business data. Patched in version 1.7.2 by adding the OrganizationScope global scope to the Snapshot model. |
|---|
| 원천 | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv |
|---|
| 사용자 | ByteJMP (UID 99294) |
|---|
| 제출 | 2026. 09. 03. AM 04:41 (29 날 ago) |
|---|
| 모더레이션 | 2026. 09. 30. PM 09:07 (28 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 412346 [David-Crty databasement 까지 1.7.1 Snapshot Model /api/v1/snapshots SnapshotPolicy.viewAny/SnapshotPolicy.view 권한 상승] |
|---|
| 포인트들 | 20 |
|---|