Mitchell45

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** A low-privileged staff account can grant arbitrary module permissions to itself, leading to persistent privilege escalation. A user possessing the `staff.create and edit staff` permission can call the `/api/admin/staff/permissions update` endpoint targeting their own account to write any permission structure, which bypasses the role-based access control boundary. **Recommendations** Update to version 0.8.0. Restrict the `staff.create and edit staff` permission to only highly trusted staff members. Use a reverse proxy or WAF to restrict access to the `/api/admin/staff/permissions update` endpoint to specific trusted roles.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions 0.5.6 through 0.7.2 **Description** When the Require Email Confirmation setting is enabled, a logged-in client with an unverified email address, indicated by the variable `email approved = 0`, can bypass page-side enforcement. This allows the user to access all client-area pages, such as the `/client/balance`, `/client/order/list`, and `/client/invoice` endpoints, and read sensitive account data, including wallet balances and transaction history. While the API correctly restricts unverified clients to profile-related endpoints, the page-side enforcement is overly permissive for any request path starting with `/client`. **Recommendations** Update FOSSBilling to version 0.8.0.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** Low-privileged staff accounts can perform unauthorized actions through admin API endpoints. This issue stems from the `can always access` module flag, which grants all staff access to specific modules, combined with unsafe parameter handling or insufficient permission checks on individual endpoints. **Recommendations** Update to version 0.8.0. Restrict staff accounts to only those who require access to sensitive settings. Use a reverse proxy or WAF to restrict access to the affected admin API endpoints to trusted IP addresses or higher-privilege roles.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions 0.5.3 through 0.7.2 **Description** Authenticated clients can read and reset API key service secrets for orders that are not in an `active` state, such as `suspended` or `canceled`. This occurs due to missing order-state validation in the `/api/client/order/service` and `/api/client/serviceapikey/reset` API endpoints, even though the `Serviceapikey` module contains an `isActive()` helper and the frontend UI restricts access based on the `order.status` variable. **Recommendations** Update to version 0.8.0. Uninstall the `Serviceapikey` module if it is not required to remove the affected endpoints. Use a reverse proxy or WAF to restrict access to the `/api/client/order/service` and `/api/client/serviceapikey/reset` endpoints based on application-level order-state logic.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** Low-privileged staff accounts can read sensitive data through admin API endpoints that lack proper permission checks. Although write endpoints enforce fine-grained permissions, the corresponding read endpoints do not have authorization guards. **Recommendations** Update to version 0.8.0. Restrict staff accounts to only those who require access to sensitive data. Use a reverse proxy or WAF to restrict access to the affected admin API endpoints.

**Name of the Vulnerable Software and Affected Versions** Bottelet DaybydayCRM versions prior to 2.2.2 **Description** An improper authorization issue exists that can be exploited remotely. The flaw is located within the `view()` function of the `app/Http/Controllers/DocumentsController.php` file. **Recommendations** Apply the security patch for versions prior to 2.2.2. As a temporary mitigation, restrict access to the `view()` function in the `app/Http/Controllers/DocumentsController.php` file.

**Name of the Vulnerable Software and Affected Versions** DevaslanPHP project-management versions prior to 2.0.0-beta1 **Description** An improper authorization issue exists in the Livewire Handler component. A remote attacker can manipulate the `editComment()` and `doDeleteComment()` functions within the `app/Filament/Resources/TicketResource/Pages/ViewTicket.php` file to gain unauthorized access or perform unauthorized actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `editComment()` and `doDeleteComment()` functions in the `app/Filament/Resources/TicketResource/Pages/ViewTicket.php` file.

**Name of the Vulnerable Software and Affected Versions** EspoCRM versions prior to 9.3.5 **Description** A business logic flaw involving broken access control allows low-privileged users to pin arbitrary notes without the necessary edit permissions for the parent object. This occurs due to a write-first, authorize-later execution flaw in the backend API where the server modifies the pinned status in the database before completing authorization, despite returning a 403 Forbidden error. The issue is located in the server-side processing of the 'POST /api/v1/Note/{id}/pin' endpoint, specifically within the `process()` method in application/Espo/Tools/Stream/Api/PostNotePin.php, which calls `getNote($id)` before `checkParent($note)`. **Recommendations** Update to version 9.3.5.