Diboot
Monthly
Tenant isolation is broken in dibo-software diboot 3.8.0, where the `/api/iam/tenant/resource` endpoint fails to enforce access controls on the user-supplied `tenantId` argument. A low-privileged authenticated user can substitute an arbitrary tenant identifier to access or modify resource assignments belonging to other tenants - a classic authorization bypass in a multi-tenant IAM context. A public proof-of-concept exploit has been disclosed; the vendor did not respond to responsible disclosure, leaving no official patch available.
Authorization bypass in dibo-software diboot 3.8.0 exposes the AI Session Endpoint (/api/ai-session/) to insecure direct object reference (IDOR) exploitation, allowing low-privilege authenticated users to access or manipulate AI session resources belonging to other users. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to verify that the requesting user is authorized to act on the referenced session identifier. A public exploit has been disclosed, and the vendor did not respond to early notification - no patch is available at time of analysis.
Tenant isolation is broken in dibo-software diboot 3.8.0, where the `/api/iam/tenant/resource` endpoint fails to enforce access controls on the user-supplied `tenantId` argument. A low-privileged authenticated user can substitute an arbitrary tenant identifier to access or modify resource assignments belonging to other tenants - a classic authorization bypass in a multi-tenant IAM context. A public proof-of-concept exploit has been disclosed; the vendor did not respond to responsible disclosure, leaving no official patch available.
Authorization bypass in dibo-software diboot 3.8.0 exposes the AI Session Endpoint (/api/ai-session/) to insecure direct object reference (IDOR) exploitation, allowing low-privilege authenticated users to access or manipulate AI session resources belonging to other users. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to verify that the requesting user is authorized to act on the referenced session identifier. A public exploit has been disclosed, and the vendor did not respond to early notification - no patch is available at time of analysis.