Threats tagged 'ghsa-8gv5-4q99-4cxm'

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed user accounts to subscribe to Server-Sent Events (SSE) streams via the /pubsub/subscribe/<topic> endpoint. This occurred because the SSE interface authenticated requests only by matching the X-API-KEY header without verifying if the account was active and confirmed. As a result, newly created accounts could access SSE streams that should be restricted to active, confirmed users, potentially exposing sensitive streaming data such as unmoderated comments. The issue stems from inconsistent authorization enforcement between the REST API and the SSE streaming interface. A patch has been developed to require accounts to be both active and confirmed before accessing Pub/Sub streams, aligning SSE authorization with the REST API.