Threats tagged 'ghsa-6q7x-48ch-3cr6'

Movim versions through 0.35.5 have an authorization bypass vulnerability in the Post::ajaxGetPost function. This flaw allows authenticated users to read restricted posts by manipulating server, node, and nodeid parameters. Specifically, attackers who know item identifiers can access cached community or contact-only posts from the pod-wide cache before the XMPP authorization check is performed. The vulnerability has a low CVSS score of 3.1 and does not impact integrity or availability.