| Название | David-Crty Databasement >= 1.2.0, < 1.7.2 Improper Access Controls |
|---|
| Описание | An insecure direct object reference (IDOR) vulnerability was identified in the Snapshot model of Databasement, an open-source Laravel-based database backup management platform. The application implements multi-tenant isolation through a global OrganizationScope applied to models like DatabaseServer and Volume. However, the Snapshot model does not register this global scope in its booted() method, despite having the OrganizationScope import present in the file. As a result, the API endpoints GET /api/v1/snapshots and GET /api/v1/snapshots/{id} return snapshots from all organizations without any tenant filtering. Any authenticated user — regardless of role or organization membership — can enumerate, read, download, restore, and delete backup snapshots belonging to every organization in the system. The SnapshotPolicy methods viewAny() and view() return true unconditionally, providing no compensating authorization check. The Livewire (web UI) path correctly applies forCurrentOrg() scoping, but the API path does not, creating an inconsistent authorization boundary. This enables full cross-tenant data exfiltration of database backups containing PII, credentials, and sensitive business data. Patched in version 1.7.2 by adding the OrganizationScope global scope to the Snapshot model. |
|---|
| Источник | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv |
|---|
| Пользователь | ByteJMP (UID 99294) |
|---|
| Представление | 03.09.2026 04:41 (28 дни назад) |
|---|
| Модерация | 30.09.2026 21:07 (28 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 412346 [David-Crty databasement до 1.7.1 Snapshot Model /api/v1/snapshots SnapshotPolicy.viewAny/SnapshotPolicy.view эскалация привилегий] |
|---|
| Баллы | 20 |
|---|