Threats tagged 'ghsa-6gm2-h9rv-g3p8'

OpenPanel versions prior to 3.0.0 have a missing authorization vulnerability in the event.bots tRPC procedure. This flaw allows unauthenticated attackers to send anonymous requests with a projectId and retrieve bot-event details such as names, types, and paths. The vulnerability exposes information for private or password-protected projects by only verifying the existence of a shareOverview row, thereby revealing internal routes.