Security vulnerabilities and automated fixes for broken access control issues
3 posts found
A critical missing authentication vulnerability in `pz_minimax.py` allowed any network-connected user to delete stored MiniMax prompts via the `DELETE /pz_easyuse/minimax-prompts/{index}` endpoint without any access control. An attacker could enumerate sequential indices to wipe all user-created prompts from the shared JSON file. The fix restricts the DELETE endpoint to localhost-only requests by checking `request.remote` against loopback addresses.
A critical authorization bypass was discovered in `plugins/tools-delete.js` where the delete command handler lacked an admin privilege check, allowing any WhatsApp group member to delete arbitrary messages. The fix adds `handler.admin = true` to enforce that only group administrators can invoke the delete functionality, preventing unauthorized message deletion by unprivileged users.
A missing cooldown configuration in Dependabot allowed the automatic proposal of newly published (and potentially malicious) package versions, creating a supply chain attack vector that could have facilitated the exploitation of CVE-2026-47343 — a broken access control vulnerability in TYPO3's File Abstraction Layer. The fix adds a 7-day cooldown period to all package ecosystem entries in `.github/dependabot.yml`, ensuring newly published packages are vetted by the community before being propose