Alf Io
Monthly
Improper access control in alf.io's organization/event-scoped 'single configuration' endpoints allows authenticated organization owners to exfiltrate system-level secrets-including the administrator system API key-by supplying arbitrary configuration key names to endpoints that perform a cross-scope lookup without restricting results to the caller's authorization tier. All alf.io deployments running versions prior to 2.0-M5-2605 where organization-owner accounts are held by partially trusted or untrusted parties are affected. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but successful retrieval of the system API key enables a secondary full administrative escalation.
Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper access control in alf.io's organization/event-scoped 'single configuration' endpoints allows authenticated organization owners to exfiltrate system-level secrets-including the administrator system API key-by supplying arbitrary configuration key names to endpoints that perform a cross-scope lookup without restricting results to the caller's authorization tier. All alf.io deployments running versions prior to 2.0-M5-2605 where organization-owner accounts are held by partially trusted or untrusted parties are affected. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but successful retrieval of the system API key enables a secondary full administrative escalation.
Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.