Threats tagged 'ghsa-g885-v5xm-xh6q'

Blossom through version 1.17.1 has an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService queries only filter by folder ID, enabling attackers to supply another user's folder ID to endpoints like /folder/info, /folder/upd, /folder/open, or /folder/del. As a result, attackers can read storage paths, rename folders, toggle visibility, or delete folders belonging to other users.