Django Vue Admin
Monthly
Improper access control in caoqianming's django-vue-admin 1.0 allows any authenticated low-privilege user to manipulate the `file_id` parameter in the `/api/file/` API endpoint, bypassing per-resource authorization checks to access or tamper with files belonging to other users. The vendor did not respond to responsible disclosure, leaving no official patch available. A publicly available proof-of-concept exploit (CVSS E:P) hosted on Google Drive substantially lowers the barrier to exploitation for any attacker with a valid account.
Improper access control in caoqianming's django-vue-admin 1.0 allows any authenticated low-privilege user to manipulate the `file_id` parameter in the `/api/file/` API endpoint, bypassing per-resource authorization checks to access or tamper with files belonging to other users. The vendor did not respond to responsible disclosure, leaving no official patch available. A publicly available proof-of-concept exploit (CVSS E:P) hosted on Google Drive substantially lowers the barrier to exploitation for any attacker with a valid account.