| tiêu đề | grimmory-tools grimmory 3.3.3 Incorrect Access Control |
|---|
| Mô tả | Grimmory 3.3.3 does not restrict the `GET /api/v1/settings` endpoint to administrators. The controller `AppSettingController.getAppSettings()` has no `@PreAuthorize(isAdmin)` check (unlike the `updateSettings` endpoint, which is restricted), so any authenticated user with a valid JWT can retrieve the full application settings object. The response includes `oidcProviderDetails.clientSecret` and third-party metadata provider API keys/cookies in plaintext, leading to disclosure of sensitive credentials. Attack: obtain a JWT via `POST /api/v1/auth/login`, then call `GET /api/v1/settings` with the bearer token.
Reproduction: https://github.com/sumo166/CVE-apply/blob/main/grimmory-tools/grimmory/GET%20api_v1_settings%20Exposes%20OIDC%20clientSecret%20and%20API%20Keys%20(CWE-863)_cve.md |
|---|
| Nguồn | ⚠️ https://github.com/grimmory-tools/grimmory/issues/2430 |
|---|
| Người dùng | summmm (UID 69690) |
|---|
| Đệ trình | 23/08/2026 07:48 (cách đây 27 ngày) |
|---|
| Kiểm duyệt | 19/09/2026 10:51 (27 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 407913 [grimmory-tools grimmory đến 3.3.3/3.4.1 Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|