Threats tagged 'ghsa-7x9g-4g72-fhmf'

PowerDNS-Admin versions up to 2026.08.1 have an authorization bypass vulnerability. Authenticated users with User-role privileges can refresh secondary DNS zones they are not authorized to access by manipulating the 'domain' field in the JSON request body. This allows attackers with access to any one zone to trigger zone transfers (axfr-retrieve) of other users' secondary zones and potentially infer the existence of those zones based on response differences.