Threats affecting pkg:github/bbs-go

mlogclub bbs-go versions up to 4.4.6 contain an authentication bypass vulnerability in the /api/login/google_one_tap endpoint. This flaw allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client without proper audience validation. Attackers can replay a victim's Google-signed ID token obtained from their own OAuth client to gain unauthorized access to the victim's Google-linked account.

bbs-go versions up to 4.4.6 contain a stored cross-site scripting (XSS) vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type header in the upload API. This enables attackers to upload malicious script-bearing documents served inline, which can execute scripts in the context of the forum when accessed by administrators.

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.