Damselfly
Monthly
Unauthenticated attackers can seize full administrative control of Webreaper Damselfly deployments through version 4.5.3 because the authorization attributes on the REST API controllers were shipped commented out, leaving every /api/* route reachable without credentials. An attacker can send PUT /api/users with an Admin role to create their own administrator account, or POST /api/users to reset any existing user's password, then use that access to read, modify, or destroy the entire photo library and its configuration. The flaw is rated CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) and classified as CWE-306; no public exploit identified at time of analysis, although a public technical writeup of the missing authorization, the upstream GitHub issue, and a VulnCheck advisory are referenced.
Unauthenticated attackers can seize full administrative control of Webreaper Damselfly deployments through version 4.5.3 because the authorization attributes on the REST API controllers were shipped commented out, leaving every /api/* route reachable without credentials. An attacker can send PUT /api/users with an Admin role to create their own administrator account, or POST /api/users to reset any existing user's password, then use that access to read, modify, or destroy the entire photo library and its configuration. The flaw is rated CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) and classified as CWE-306; no public exploit identified at time of analysis, although a public technical writeup of the missing authorization, the upstream GitHub issue, and a VulnCheck advisory are referenced.