Bluehood
Monthly
Unauthenticated access to Bluehood's /api/* endpoints in releases before 0.7.1 lets any network attacker who can reach the dashboard HTTP port read Bluetooth tracking data and rewrite application state - the heartbeat URL, prune retention, device groups and per-device notes - whenever the operator has enabled the opt-in auth_enabled setting. The root cause is a missing authorization check: only the HTML page handlers called the session-validation routine, while the settings, devices, groups and /api/device/{mac}/notes handlers performed no check at all, allowing requests carrying no session cookie to succeed (CWE-306, CVSS 3.1 9.1 with PR:N/AC:L). Real-world urgency is tempered by the niche deployment and the fact that the dashboard must be reachable over the network rather than bound to localhost; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated access to Bluehood's /api/* endpoints in releases before 0.7.1 lets any network attacker who can reach the dashboard HTTP port read Bluetooth tracking data and rewrite application state - the heartbeat URL, prune retention, device groups and per-device notes - whenever the operator has enabled the opt-in auth_enabled setting. The root cause is a missing authorization check: only the HTML page handlers called the session-validation routine, while the settings, devices, groups and /api/device/{mac}/notes handlers performed no check at all, allowing requests carrying no session cookie to succeed (CWE-306, CVSS 3.1 9.1 with PR:N/AC:L). Real-world urgency is tempered by the niche deployment and the fact that the dashboard must be reachable over the network rather than bound to localhost; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.