Threats affecting pkg:github/tamery

Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to manipulate the client-supplied chatId parameter, enabling them to move messages with arbitrary content into another user's AI chat history. The vulnerability is fixed in version 0.99.0.

Tamery versions from 0.32.0 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's connectionsResources.create handler. This flaw allows authenticated users to attach resources to other users' connections by including a victim's connectionId in batch requests. The issue is fixed in version 0.99.0.