Cyberkareem

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking an explicit permissions configuration, bypassing intended authorization controls.

grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core dispatches the task from the GET 'task:' URI parameter and the default session cookie is SameSite=Lax, an attacker can lure a logged-in victim to an off-site page that performs a top-level GET navigation, rotating the victim's TOTP secret so their enrolled authenticator no longer matches the server, effectively forcing 2FA re-enrollment. Sites configured with session.samesite: Strict are not affected.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions 9.0.0 through 9.10.0-alpha.1 Parse Server versions 8.x through 8.6.83 **Description** A stored cross-site scripting (XSS) issue exists when the software fails to recognize an uploaded file's extension via the mime package, leading it to preserve the client-supplied Content-Type. A malformed Content-Type that does not follow a valid type/subtype media type format (for example, 'image', 'image/', or 'image//svg+xml') can bypass the `fileUpload.fileExtensions` blocklist and be stored without modification. When using storage adapters that persist and serve the uploaded Content-Type, such as Amazon S3, Google Cloud Storage, or Azure Blob Storage, browsers may fail to parse the malformed value and perform MIME-sniffing. This allows a file starting with HTML to be rendered as HTML, executing embedded scripts in the application's origin against users who access the file URL. The default GridFS storage adapter is not affected. **Recommendations** Update to version 9.10.0-alpha.2 or later. Update to version 8.6.84 or later.