Threats affecting pkg:npm/Firekylin

Firekylin versions up to 2.18.1 have an improper authorization vulnerability that allows users with editor roles to access administrator-only secrets. This occurs because the admin API base guard permits all GET requests, enabling editors to retrieve sensitive data such as TOTP secrets, push credentials, cloud storage keys, and other users' app keys and secrets. This flaw can lead to unauthorized actions like publishing posts as administrators.