Lingguo Drama
Monthly
Missing authorization in LingGuo-Drama through commit 8a6924a allows any authenticated self-registered user to fully manage all accounts via the /admin/v1/admins API. The API trusts any valid AuthAdminJWT without verifying the caller's authority level, enabling attackers to read every account's bcrypt hash, reset the bootstrap administrator's password, raise their own authority_id, and delete accounts. This is a genuine, high-priority access-control flaw (CVSS 8.7) with no public exploit identified at time of analysis; exploitation requires only that self-registration is enabled and the service is network-accessible.
Broken access control in LingGuo-Drama at and through commit 8a6924adf8142678919b4d9a08b9d60c49dcfbed lets any self-registered, low-privilege user read, overwrite, reassign, or delete other users' short-drama projects by iterating numeric IDs against the admin API endpoints GET, PUT, and DELETE /admin/v1/projects/:id. The root cause is CWE-639: the projects.Get helper omits an owner check, so the object identifier supplied by the caller is trusted without verifying that the authenticated principal owns the referenced project. Exploitation requires an authenticated account (CVSS PR:L, obtainable through self-registration where enabled) and network reach to the admin API; no public exploit identified at time of analysis, and there is no KEV entry or EPSS signal to suggest active exploitation in the wild.
Missing authorization in LingGuo-Drama through commit 8a6924a allows any authenticated self-registered user to fully manage all accounts via the /admin/v1/admins API. The API trusts any valid AuthAdminJWT without verifying the caller's authority level, enabling attackers to read every account's bcrypt hash, reset the bootstrap administrator's password, raise their own authority_id, and delete accounts. This is a genuine, high-priority access-control flaw (CVSS 8.7) with no public exploit identified at time of analysis; exploitation requires only that self-registration is enabled and the service is network-accessible.
Broken access control in LingGuo-Drama at and through commit 8a6924adf8142678919b4d9a08b9d60c49dcfbed lets any self-registered, low-privilege user read, overwrite, reassign, or delete other users' short-drama projects by iterating numeric IDs against the admin API endpoints GET, PUT, and DELETE /admin/v1/projects/:id. The root cause is CWE-639: the projects.Get helper omits an owner check, so the object identifier supplied by the caller is trusted without verifying that the authenticated principal owns the referenced project. Exploitation requires an authenticated account (CVSS PR:L, obtainable through self-registration where enabled) and network reach to the admin API; no public exploit identified at time of analysis, and there is no KEV entry or EPSS signal to suggest active exploitation in the wild.