Threats tagged 'ghsa-6r6m-8qp2-f3cm'

Psono Server Community Edition versions 1.12.6 through 7.5.0 and Enterprise Edition before 7.5.1 have an authorization flaw in the DELETE /share/right/ endpoint. This flaw allows an authenticated user invited to a group with share-admin privileges to delete group share-rights without having accepted the group invitation. This can revoke access to shared secrets for all accepted group members without deleting the underlying data or exposing secret contents. The issue was fixed in version 7.5.1.