Threats tagged 'ghsa-cvf5-89v8-6rq2'

Firekylin versions through 2.18.1 have an improper authorization vulnerability that allows users with editor roles to access administrator-only secrets. This occurs because the admin API base guard permits all GET actions, enabling editors to retrieve sensitive data such as TOTP secrets, push credentials, cloud storage keys, and other users' app_key/app_secret. This could allow editors to publish posts as administrators.