| tiêu đề | David-Crty Databasement >= 1.2.0, < 1.7.2 Improper Access Controls |
|---|
| Mô tả | An insecure direct object reference (IDOR) vulnerability was identified in the Snapshot model of Databasement, an open-source Laravel-based database backup management platform. The application implements multi-tenant isolation through a global OrganizationScope applied to models like DatabaseServer and Volume. However, the Snapshot model does not register this global scope in its booted() method, despite having the OrganizationScope import present in the file. As a result, the API endpoints GET /api/v1/snapshots and GET /api/v1/snapshots/{id} return snapshots from all organizations without any tenant filtering. Any authenticated user — regardless of role or organization membership — can enumerate, read, download, restore, and delete backup snapshots belonging to every organization in the system. The SnapshotPolicy methods viewAny() and view() return true unconditionally, providing no compensating authorization check. The Livewire (web UI) path correctly applies forCurrentOrg() scoping, but the API path does not, creating an inconsistent authorization boundary. This enables full cross-tenant data exfiltration of database backups containing PII, credentials, and sensitive business data. Patched in version 1.7.2 by adding the OrganizationScope global scope to the Snapshot model. |
|---|
| Nguồn | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv |
|---|
| Người dùng | ByteJMP (UID 99294) |
|---|
| Đệ trình | 03/09/2026 04:41 (cách đây 28 ngày) |
|---|
| Kiểm duyệt | 30/09/2026 21:07 (28 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 412346 [David-Crty databasement đến 1.7.1 Snapshot Model /api/v1/snapshots SnapshotPolicy.viewAny/SnapshotPolicy.view nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|