Threats tagged 'ghsa-h238-5mwf-8xw8'

An unauthenticated access vulnerability in lakeFS allows anyone to retrieve aggregate API usage metrics from the /api/v1/usage-report/summary endpoint. Although no sensitive data is exposed, this information could reveal service activity or uptime patterns. The issue affects versions prior to 1.71.0 and has a medium severity rating with a CVSS score of 5.3. A fix is available in version 1.71.0. Workarounds include disabling usage reporting or blocking the endpoint via a load balancer or application firewall.