Highaklish

**Name of the Vulnerable Software and Affected Versions** Elide versions prior to 6.1.4 **Description** The issue arises when using Elide Aggregation Data Store for Analytic Queries, Parameterized Columns, and a parameterized column of type TEXT. This combination allows a hacker to craft a query that bypasses server-side authorization filters through SQL injection. A recent patch in Elide 6.1.2 introduced the vulnerability by allowing the '-' character in parameterized TEXT columns, which can be interpreted as SQL comments ('--') and remove the WHERE clause from the generated query. The vulnerability only affects parameterized columns of type TEXT and analytic queries, not CRUD operations. **Recommendations** For versions prior to 6.1.4, update to Elide 6.1.4 to resolve the issue. As a temporary workaround, consider leveraging a different type of parameterized column, such as TIME or MONEY, or avoid using parameterized columns altogether.

**Name of the Vulnerable Software and Affected Versions** Elide versions prior to 4.5.14 **Description** It is possible for an adversary to "guess and check" the value of a model field they do not have access to, assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field. For example, using a filter like `filter=role=="Admin"` on a User model, the adversary can determine which users have an admin role by presence or absence in the returned collection. **Recommendations** For versions prior to 4.5.14, update to Elide 4.5.14 or greater to resolve the issue. As a temporary workaround, consider restricting read permissions on existing models to prevent access to fields with different permission levels.