Threats tagged 'ghsa-g5w6-2w7g-5hvq'

OpsTree REMS versions through 1.0.0 have an improper authorization vulnerability that allows authenticated users to change the reporter of an incident to another user. This is done by supplying a client-controlled reporter field in POST or PATCH requests, enabling falsification of incident attribution and corruption of the accountability audit trail.