| 标题 | David-Crty Databasement >= 1.2.0, < 1.7.2 Improper Access Controls |
|---|
| 描述 | An insecure direct object reference (IDOR) vulnerability was identified in the Snapshot model of Databasement, an open-source Laravel-based database backup management platform. The application implements multi-tenant isolation through a global OrganizationScope applied to models like DatabaseServer and Volume. However, the Snapshot model does not register this global scope in its booted() method, despite having the OrganizationScope import present in the file. As a result, the API endpoints GET /api/v1/snapshots and GET /api/v1/snapshots/{id} return snapshots from all organizations without any tenant filtering. Any authenticated user — regardless of role or organization membership — can enumerate, read, download, restore, and delete backup snapshots belonging to every organization in the system. The SnapshotPolicy methods viewAny() and view() return true unconditionally, providing no compensating authorization check. The Livewire (web UI) path correctly applies forCurrentOrg() scoping, but the API path does not, creating an inconsistent authorization boundary. This enables full cross-tenant data exfiltration of database backups containing PII, credentials, and sensitive business data. Patched in version 1.7.2 by adding the OrganizationScope global scope to the Snapshot model. |
|---|
| 来源 | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv |
|---|
| 用户 | ByteJMP (UID 99294) |
|---|
| 提交 | 2026-09-03 04時41分 (29 日前) |
|---|
| 管理 | 2026-09-30 21時07分 (28 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 412346 [David-Crty databasement 直到 1.7.1 Snapshot Model /api/v1/snapshots SnapshotPolicy.viewAny/SnapshotPolicy.view 权限提升] |
|---|
| 积分 | 20 |
|---|