Threats tagged 'ghsa-gm3x-2x46-fc3v'

FastBee versions up to 2.1.0 have an insecure direct object reference vulnerability that allows authenticated low-privilege users to access and manipulate other users' device groups. This occurs because the GroupController does not verify ownership when querying groups. Attackers can read, overwrite, reassign, or delete device groups belonging to other users by supplying sequential group IDs.