Threats tagged 'ghsa-f65r-h4g3-3h9h'

Backpropagate versions 1.1.0 and 1.1.1 include a Reflex web UI that exposes training controls without enforcing authentication despite operator-facing flags claiming to do so. This allows any client able to reach the UI port to access sensitive functions such as reading uploaded datasets, triggering training runs, pushing to HuggingFace Hub repositories, and causing denial-of-service via disk fill. The vulnerability arises because the backend never reads the authentication environment variable and lacks middleware to enforce access control. The issue is fixed in version 1.2.0 with proper authentication middleware and multiple defense layers.