Threats tagged 'ghsa-ch7p-78m2-fq4j'

lamp-cloud versions up to and including 5.10.0 have an authorization bypass vulnerability in the deleteMyNotice endpoint. Authenticated users can delete notifications belonging to other users by calling the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs. This occurs due to lack of recipient validation, allowing unauthorized deletion of notifications.