Threats tagged 'ghsa-7c2w-92qq-g97q'

holaOS versions up to 2026.822.1 contain an authorization bypass vulnerability in the channel-gateway Telegram connector. The vulnerability arises because the connector authorizes senders based on mutable usernames instead of immutable numeric IDs. This flaw allows attackers who register a released username listed in the allowFrom configuration to submit commands to the bound workspace agent, potentially executing configured tools on the operator's machine.