George Chen

**Name of the Vulnerable Software and Affected Versions** Rowboat versions prior to 0.9.2 **Description** Authenticated users can configure arbitrary destinations because the software fails to validate custom MCP server and webhook URLs. This allows attackers to point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery (SSRF)—a technique where the server is coerced into making requests to an unintended location—and enumerate internal network topology. **Recommendations** Update Rowboat to version 0.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** Pterodactyl Panel versions prior to 1.14.1 **Description** The software fails to validate action-specific permissions during the creation of scheduled tasks. This allows subusers who possess only the `schedule.update` permission to execute arbitrary console commands. An attacker can create and immediately trigger scheduled tasks to run game-server console commands, control the server power state, or create backups without the required authorization checks. **Recommendations** Update Pterodactyl Panel to version 1.14.1 or later.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.3.18 **Description** An authentication bypass exists in the OAuth callback handler. The system signs users into existing accounts based solely on the email address without verifying provider assertions or binding OAuth identities. This allows an attacker to register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication. **Recommendations** Update to version 4.3.18 or later.

**Name of the Vulnerable Software and Affected Versions** Cua computer-server versions prior to 0.3.42 **Description** Authentication is bypassed when the `CONTAINER NAME` environment variable is unset, as the server binds to all interfaces by default. This allows unauthenticated attackers to execute arbitrary commands via the 'run command' endpoint, perform read and write operations on arbitrary files through file operation endpoints, and access interactive PTY shells. **Recommendations** Update Cua computer-server to version 0.3.42 or later. Ensure the `CONTAINER NAME` environment variable is properly set to enable authentication.

**Name of the Vulnerable Software and Affected Versions** MindsDB versions prior to 26.1.1 **Description** A server-side request forgery (SSRF) issue exists in the web crawler handler. This allows unauthenticated attackers to fetch arbitrary URLs by providing caller-controlled URLs to the `CrawlerTable.list` function. By exploiting the default empty configuration, attackers can bypass allowlist controls to access internal services and cloud metadata endpoints without authentication. **Recommendations** Update MindsDB to version 26.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** NetBox versions prior to 4.7.1 **Description** Authenticated users with view permissions can access private records of all users due to improper scoping of querysets. This issue affects the REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks, disclosing which users watch or bookmark specific objects. **Recommendations** Update NetBox to version 4.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** BookWyrm versions prior to 0.9.2 **Description** An authorization bypass exists in the `edit readthrough()` function. Authenticated users can exploit sequential ReadThrough IDs to modify reading records belonging to other users. This allows the unauthorized overwriting of `start dates`, `finish dates`, `progress`, and `progress mode`, which impacts reading statistics and exported data. **Recommendations** Update BookWyrm to version 0.9.2 or later. As a temporary workaround, restrict access to the `edit readthrough()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Metabase versions prior to 0.63.1 **Description** Authenticated users can create, modify, and delete glossary entries because the software fails to enforce data analyst permission checks on glossary API endpoints. This allows unauthorized users to tamper with instance-wide business glossary data by submitting requests to the POST, PUT, and DELETE glossary endpoints. **Recommendations** Update to version 0.63.1 or later.

**Name of the Vulnerable Software and Affected Versions** Webstudio versions prior to 0.296.0 **Description** An unauthenticated server-side request forgery (SSRF) exists when the `RESIZE ORIGIN` environment variable is unset. This allows attackers to provide arbitrary URLs to the '/cgi/image', '/cgi/video', and '/cgi/asset' proxy endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Update to a version newer than 0.296.0. Set the `RESIZE ORIGIN` environment variable to restrict the proxy routes.

**Name of the Vulnerable Software and Affected Versions** APITable versions prior to 1.13.0-beta.1 **Description** An incorrect authorization issue exists in the `NodePermissionGuard` component. The system fails to enforce node-level access control when permission lookups trigger exceptions. This allows attackers possessing valid Fusion API tokens to write attachments to private datasheets, even if they have been explicitly denied access, by triggering an unhandled exception within the permission guard. **Recommendations** Update to a version later than 1.13.0-beta.1.

**Name of the Vulnerable Software and Affected Versions** SQL Chat (affected versions not specified) **Description** Four unauthenticated API endpoints accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. This allows attackers to connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server network without authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AutoAgent (affected versions not specified) **Description** An unauthenticated remote code execution issue exists in the TCP server that binds to all interfaces. This allows an attacker to connect to the exposed communication port and execute arbitrary bash commands as root within the container, which can lead to unauthorized access to bind-mounted host workspace directories. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Plane versions prior to 1.4.3 **Description** Authenticated attackers can post comments to arbitrary issues across different workspaces. This occurs because the software fails to validate whether issues belong to the deploy board's project when using the public comment endpoint. The attack is executed by supplying a specific `issue id` parameter to the public deploy-board comment endpoint. **Recommendations** Update to version 1.4.3 or later. Restrict access to the public deploy-board comment endpoint to minimize the risk of unauthorized comment posting.

**Name of the Vulnerable Software and Affected Versions** NetBox versions prior to 4.7.1 **Description** NetBox fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permissions can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, potentially leading to unauthorized access to external repositories and storage buckets. **Recommendations** Update NetBox to version 4.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** BookWyrm versions prior to 0.9.2 **Description** Authenticated attackers can read restricted reviews, including those set to followers-only or direct-message, by enumerating sequential status IDs. This occurs because the software fails to validate user visibility permissions at the status edit endpoint. By accessing the edit view, attackers can bypass privacy protections and read the raw content of these restricted statuses. **Recommendations** Update BookWyrm to version 0.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** BookWyrm versions prior to 0.9.2 **Description** Authenticated attackers can favorite or unfavorite statuses that are restricted to followers-only or direct visibility due to a failure in validating user visibility permissions within the Favorite and Unfavorite views. By sending a POST request to the favorite endpoint with a specific status ID, an attacker can create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs by analyzing differences in the server responses. **Recommendations** Update BookWyrm to version 0.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** Arcane versions prior to 2.0.0 **Description** Insufficient restrictions on template operations allow accounts with the default user role to create, modify, and delete compose templates, including instance-wide defaults. This allows for the injection of malicious container configurations featuring privileged settings or host path mounts, which execute with administrative privileges when deployed by administrators. **Recommendations** Update to version 2.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** Sim versions prior to 0.8.14 **Description** The software incorrectly classifies tool requests as internal by using URL prefix matching without scheme normalization. This flaw allows authenticated workflow authors to bypass Server-Side Request Forgery (SSRF) validation—a vulnerability where an attacker induces a server-side application to make requests to an unintended location—and obtain internal authentication tokens. By providing paths starting with `/api/` in HTTP blocks, an attacker can access internal-only endpoints, such as the `POST /api/function/execute` endpoint. **Recommendations** Update to version 0.8.14 or later.

**Name of the Vulnerable Software and Affected Versions** gonic versions prior to 0.22.0 **Description** Authenticated users can trigger media library rescans because the software fails to validate administrator privileges at the 'startScan' endpoint. By repeatedly calling this endpoint, an attacker can force CPU and I/O-intensive filesystem operations, leading to a denial of service on multi-user instances. **Recommendations** Update to version 0.22.0 or later. As a temporary workaround, restrict access to the 'startScan' endpoint to prevent unauthorized users from triggering rescans.

**Name of the Vulnerable Software and Affected Versions** Pixelfed versions prior to 0.12.10 **Description** Authenticated users can access stories restricted to followers due to a failure to validate follower status in the `StoryComposeController` react and comment endpoints. By enumerating sequential story IDs and submitting reactions or comments, an attacker can retrieve author information and media URLs of the stories. **Recommendations** Update Pixelfed to version 0.12.10 or later. Restrict access to the `StoryComposeController` react and comment endpoints as a temporary mitigation measure.