53Aihub
Monthly
Unauthenticated attackers can overwrite enterprise profile data in 53AIHub through version 0.5.3 by sending crafted PUT requests to /api/enterprises/:id when the deployment does not have IS_SAAS set to true. This allows modification of logos, display names, and branding, enabling defacement or phishing. The independent assessment rates this as a moderate-severity integrity-only issue with no data disclosure or service disruption; no public exploit identified at time of analysis. Deployments correctly configured with IS_SAAS=true are not vulnerable because authorization checks engage in that mode.
Unauthenticated attackers can overwrite enterprise profile data in 53AIHub through version 0.5.3 by sending crafted PUT requests to /api/enterprises/:id when the deployment does not have IS_SAAS set to true. This allows modification of logos, display names, and branding, enabling defacement or phishing. The independent assessment rates this as a moderate-severity integrity-only issue with no data disclosure or service disruption; no public exploit identified at time of analysis. Deployments correctly configured with IS_SAAS=true are not vulnerable because authorization checks engage in that mode.