Fonoster
Monthly
Incorrect authorization in Fonoster through 0.22.7 allows any authenticated user to rename arbitrary workspaces across the entire deployment. The `Identity/UpdateWorkspace` gRPC handler in `createUpdateWorkspace.ts` issues a PERMISSION_DENIED callback upon failing a membership check but omits a `return` statement, so `prisma.workspace.update` executes regardless and commits the rename before a second error callback fires. Compounding the flaw, the `Identity/UpdateWorkspace` path is misclassified under `fullIdentityAccess` in the gRPC interceptor rather than workspace-scoped access controls, meaning the base USER role is sufficient for exploitation. No public exploit is identified at time of analysis; CVSS 4.0 rates this 5.3 (Medium) with low-privilege, network-accessible exploitation.
Incorrect authorization in Fonoster through 0.22.7 allows any authenticated user to rename arbitrary workspaces across the entire deployment. The `Identity/UpdateWorkspace` gRPC handler in `createUpdateWorkspace.ts` issues a PERMISSION_DENIED callback upon failing a membership check but omits a `return` statement, so `prisma.workspace.update` executes regardless and commits the rename before a second error callback fires. Compounding the flaw, the `Identity/UpdateWorkspace` path is misclassified under `fullIdentityAccess` in the gRPC interceptor rather than workspace-scoped access controls, meaning the base USER role is sufficient for exploitation. No public exploit is identified at time of analysis; CVSS 4.0 rates this 5.3 (Medium) with low-privilege, network-accessible exploitation.