Axonhub
Monthly
Privilege escalation in AxonHub through 1.0.0-beta11 lets an authenticated project user who holds the write_api_keys scope mint a service_account API key carrying system-level scopes such as read_channels, then call the /admin/graphql endpoint to read every channel's configuration, including base URLs and model lists. Exploitation requires an authenticated principal with that project-level scope (CVSS PR:L) and no user interaction; the assessed vector rates confidentiality impact as low with no integrity or availability effect, and broader exposure depends on which system-level scopes the attacker chooses to mint because the pre-patch code did not restrict them. A public technical writeup of the scope-grant flaw exists but is not verified as working exploit code, and the vendor has published an upstream fix (PR #2741 / commit e5c904ef); there is no CISA KEV entry and the issue is triaged as this_month rather than an emergency.
Privilege escalation in AxonHub through 1.0.0-beta11 lets an authenticated project user who holds the write_api_keys scope mint a service_account API key carrying system-level scopes such as read_channels, then call the /admin/graphql endpoint to read every channel's configuration, including base URLs and model lists. Exploitation requires an authenticated principal with that project-level scope (CVSS PR:L) and no user interaction; the assessed vector rates confidentiality impact as low with no integrity or availability effect, and broader exposure depends on which system-level scopes the attacker chooses to mint because the pre-patch code did not restrict them. A public technical writeup of the scope-grant flaw exists but is not verified as working exploit code, and the vendor has published an upstream fix (PR #2741 / commit e5c904ef); there is no CISA KEV entry and the issue is triaged as this_month rather than an emergency.