| Название | dibo-software diboot v3.8.0 Broken Access Control |
|---|
| Описание | The tenant resource assignment endpoints expose a tenant-scoped Broken Access Control issue. The controller accepts a caller-supplied tenantId directly in both the read and write routes,then forwards it to the service layer without checking whether the authenticated user actually owns that tenant or has any management authority over it. In GET /api/iam/tenant/resource/{tenantId}, the API returns the tenant’s current resource IDs by querying only on tenantId. In POST /api/iam/tenant/resource/{tenantId}, the API rewrites the many-to-many tenant-resource mapping by passing the same tenantId and attacker-controlled ids list into the relation update helper. Because there is no object-level permission check and no tenant boundary validation, any authenticated user who knows or guesses a valid tenantId can enumerate that tenant’s authorization set and arbitrarily grant or revoke permissions. |
|---|
| Источник | ⚠️ https://drive.google.com/file/d/1qFtwq78JN5Af3GlSD2utfQIbOPBaaQ47/view?usp=sharing |
|---|
| Пользователь | Stephen Lin (UID 98370) |
|---|
| Представление | 01.07.2026 09:41 (2 месяцы назад) |
|---|
| Модерация | 31.08.2026 07:33 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 397235 [dibo-software diboot 3.8.0 Tenant Resource Assignment /api/iam/tenant/resource tenantId эскалация привилегий] |
|---|
| Баллы | 20 |
|---|