CyberPanel before version 2.4.4 contains a logic omission in the `checkOwnership()` access control function that allows authenticated low-privilege users to bypass domain ownership verification. The `plogical/acl.py` module's `checkOwnership()` function lacked a `return 0` in its denial branch, causing it to implicitly return `None` instead of an explicit denial signal when a requesting user does not own the target domain. An authenticated user can exploit this to access domain-level information belonging to other panel users. No public exploit or CISA KEV listing exists at time of analysis.
CyberPanel versions before 2.4.4 fail to record audit log entries when authenticated panel users interact with the child domains management interface, allowing configuration manipulation to proceed without any forensic trail. The upstream fix commit also reveals a companion access-control defect: a missing return path in the ACL ownership check (checkOwnership() in acl.py) and an ORM filter regression in fetchChildDomainsMain that broadened the child domain result set beyond intended alias-excluded entries. Together, these gaps allow an authenticated low-privilege user to alter domain list state silently, undermining post-incident accountability. No public exploit has been identified at time of analysis.
Identity spoofing in Forgejo's ActivityPub federation allows a remote attacker who controls any single valid ActivityPub actor and keypair to submit HTTP-Signature-valid activities falsely attributed to arbitrary actor identities on a target instance. Affected versions span 13.0.0 through 16.0.4, but only when federation is explicitly enabled via the non-default setting `[federation] ENABLED = true`. The vendor explicitly confirms this does not permit account takeover or content modification - impact is limited to false attribution of federated activities. No public exploit has been identified at time of analysis.
Authorization bypass in Apache Storm Logviewer 3.0.0 exposes daemon logs and tenant log file listings to any filter-authenticated user, entirely disregarding the configured `logs.users` and `logs.groups` access controls. A boolean short-circuit in the daemon log authorization path discards the authorizer's decision whenever the daemon-log flag is set, and the daemon log page and download endpoints are reached without consulting an authorizer at all; additionally, the listing endpoints `/listLogs` and `/searchLogs` accept a user argument but never apply it. On a multi-tenant Storm cluster, any user who passes the servlet filter can read nimbus.log, supervisor.log, and other daemon logs-which contain co-tenant topology names, job owners, and configuration fragments-and enumerate all worker log file names. No public exploit identified at time of analysis.