Threats tagged 'ghsa-2pxm-2w6p-33p8'

Omnispace Agora Project versions before 26.10.0 have a broken access control vulnerability in the MobileFileDownload route. This flaw allows unauthenticated attackers to bypass authorization by computing an md5 hash of the filename, enabling them to download arbitrary protected files. The vulnerability leads to unauthorized information disclosure without requiring user interaction or privileges.