Threats tagged 'ghsa-62f6-6f4g-pr5m'

Blinko versions up to 1.8.8 have an authorization bypass vulnerability in the /api/file route. Authenticated users can exploit a flawed owner check to access private attachments of other users by supplying a filename pattern based on basename and millisecond timestamp. This allows unauthorized reading of private, non-shared files.