Threats tagged 'ghsa-cvgf-hhh8-56v5'

AxonHub versions up to 1.0.0-beta11 have a privilege escalation vulnerability that allows project users with certain API key permissions to create service_account API keys with system-level scopes without proper validation. This flaw enables attackers holding write_api_keys to mint keys with read_channels scope and query administrative GraphQL endpoints to access all channel configurations, including sensitive details like base URLs and model lists.