Threats tagged 'ghsa-j948-r3jj-xhjm'

Miaomiaowu versions before 0.9.3 have an insecure direct object reference (IDOR) vulnerability in the /api/user/proxy-provider-configs endpoint. This flaw allows authenticated users to access other users' proxy provider configurations by iterating the global auto-increment external_subscription_id parameter. The exposed data includes override scripts, filter rules, custom request headers, and health-check URLs. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity.