Adminset
Monthly
Authorization bypass in guohongze adminset 0.61 and earlier allows authenticated remote attackers to access or manipulate deployment resources belonging to other projects by substituting arbitrary project_id values in requests to the Delivery Deployment Endpoint (delivery/deli.py). This CWE-639 flaw - Authorization Bypass Through User-Controlled Key - is a classic IDOR pattern where the application accepts user-supplied object identifiers without verifying ownership. A public proof-of-concept exploit is available via GitHub issue #161, and the vendor has not responded to the responsible disclosure; no patch exists at time of analysis.
Authorization bypass in guohongze adminset 0.61 and earlier allows authenticated remote attackers to access or manipulate deployment resources belonging to other projects by substituting arbitrary project_id values in requests to the Delivery Deployment Endpoint (delivery/deli.py). This CWE-639 flaw - Authorization Bypass Through User-Controlled Key - is a classic IDOR pattern where the application accepts user-supplied object identifiers without verifying ownership. A public proof-of-concept exploit is available via GitHub issue #161, and the vendor has not responded to the responsible disclosure; no patch exists at time of analysis.