Threats tagged 'ghsa-8wfx-4q5w-fv72'

53AIHub versions up to 0.5.3 have a missing authentication vulnerability allowing unauthenticated attackers to overwrite enterprise profiles via PUT requests to /api/enterprises/:id. This flaw enables attackers to change logos, display names, and branding, facilitating defacement and phishing. The vulnerability exists because authentication checks are only enforced when IS_SAAS is true, which is not the case here.