Archerysec
Monthly
Cross-tenant information disclosure in ArcherySec through 2.0.6 allows any authenticated user to read web vulnerability findings belonging to other organizations by supplying arbitrary or enumerated scan identifiers to the WebScanVulnList endpoint, which performs no organization-ownership check. Rated 7.1 (CVSS 4.0) and mapped to CWE-639, the flaw is a classic IDOR/BOLA: exploitation is remote and low-complexity and requires only a valid low-privilege login (PR:L per the assessed vector), with impact confined to confidentiality (full read of titles, severities, statuses and analyst notes) and no modification or denial of service. Risk is materially higher on shared multi-tenant deployments where several organizations coexist on one instance; single-organization installs have no other tenants to leak from, and there is no public exploit identified at time of analysis.
Cross-tenant information disclosure in ArcherySec through 2.0.6 allows any authenticated user to read web vulnerability findings belonging to other organizations by supplying arbitrary or enumerated scan identifiers to the WebScanVulnList endpoint, which performs no organization-ownership check. Rated 7.1 (CVSS 4.0) and mapped to CWE-639, the flaw is a classic IDOR/BOLA: exploitation is remote and low-complexity and requires only a valid low-privilege login (PR:L per the assessed vector), with impact confined to confidentiality (full read of titles, severities, statuses and analyst notes) and no modification or denial of service. Risk is materially higher on shared multi-tenant deployments where several organizations coexist on one instance; single-organization installs have no other tenants to leak from, and there is no public exploit identified at time of analysis.