Mrknight-N1Du

**Name of the Vulnerable Software and Affected Versions** Daytona versions prior to 0.185.0 **Description** Organization role update and delete endpoints authorized the caller as an owner of the organization in the request path but mutated the target role using only its identifier without verifying the role belonged to that organization. This results in a cross-tenant broken access control (IDOR - Insecure Direct Object Reference), where an authenticated user owning any organization could modify permissions or delete a role belonging to a different organization if the role identifier is known. An attacker could overwrite a target role's name and permission set to escalate or strip privileges, delete the role, or observe the current permission set via the update response. **Recommendations** Update to version 0.185.0.

**Name of the Vulnerable Software and Affected Versions** e107 versions prior to 2.3.5 **Description** e107 is a content management system (CMS) that fails to properly enforce Cross-Site Request Forgery (CSRF) token validation on comment moderation actions. The issue occurs within the `session handler::check()` function, which only validates the CSRF token if it is present in the request. If the token is completely missing, the validation check is skipped, allowing state-changing requests to be processed without authentication. This affects the 'comment.php' moderation endpoints. **Recommendations** Update to version 2.3.5.

**Name of the Vulnerable Software and Affected Versions** Daytona versions 0.101.0 through 0.183.0 **Description** Sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change. This occurs because a cached visibility state was not invalidated when the sandbox visibility changed, allowing the preview proxy to continue serving unauthenticated requests to ordinary preview ports for a bounded period. This issue only affects sandboxes that were previously public and then set to private. Terminal, toolbox, and recording-dashboard ports are not affected as they always require authentication. The issue does not involve cross-tenant access, privilege escalation, or remote code execution. **Recommendations** Update to version 0.184.0.