Octocloud
Monthly
Authorization bypass in OctoCloud 1.12.06 lets an authenticated low-privilege user access functionality and data they should not be permitted to reach, because the application trusts a user-supplied key when making access-control decisions. Successful exploitation allows high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), though the attacker must already hold a valid low-privilege account - this is not a remote-unauthenticated flaw. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied; the vulnerable endpoint and parameter are not disclosed in the available TR-CERT advisory. Only the 1.12.06 release line up to (but not including) 1.12.07 is affected.
Authorization bypass in OctoCloud 1.12.06 lets an authenticated low-privilege user access functionality and data they should not be permitted to reach, because the application trusts a user-supplied key when making access-control decisions. Successful exploitation allows high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), though the attacker must already hold a valid low-privilege account - this is not a remote-unauthenticated flaw. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied; the vulnerable endpoint and parameter are not disclosed in the available TR-CERT advisory. Only the 1.12.06 release line up to (but not including) 1.12.07 is affected.