Threats tagged 'ghsa-4g9p-3cc5-xh4q'

NocoBase plugin-ai versions 2.1.0 through 2.2.41 contain an authorization bypass vulnerability in the getAccessibleAIEmployee() function. This flaw allows authenticated users to override role-based filters by supplying a username, enabling access to AI employees not assigned to them. Exploitation can lead to unauthorized execution of AI employees with their associated permissions and reading of their prompts and tool configurations.