Threats tagged 'ghsa-gjpm-3829-v3j3'

Eclipse BaSyx Go Components versions up to and including 1.1.3 have an access control bypass vulnerability in ABAC-enabled deployments. The issue arises because access rules match the fully decoded request path, while routing uses the raw encoded path. This discrepancy allows an authenticated user with limited read permissions on parts of a resource to access the entire resource if the resource identifier contains encoded slashes. The vulnerability is fixed in version 1.1.4.