Threats tagged 'ghsa-2x8q-m4r9-vg7h'

ShowDoc versions through 3.9.5 have an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint. The endpoint only verifies edit permission for the first entry ID supplied, allowing authenticated attackers to delete parameter-description entries belonging to other users by manipulating the order of entry IDs in the request.