Paopao Ce
Monthly
Authenticated users of Rocboss paopao-ce through 0.6.0-alpha.3 can obtain signed download URLs for other users' private, friend-only, and following-only media by requesting arbitrary content IDs from the /v1/attachment endpoint. Because post_content IDs are sequential, an ordinary registered low-privileged account (no administrative role required) is enough to enumerate IDs and harvest images, videos, and attachments belonging to other users, giving a high confidentiality impact with no write or availability effect. This is a genuine but bounded data-confidentiality issue rather than a critical infrastructure threat; no public exploit code was identified at time of analysis, although a public technical write-up describing the cross-user IDOR is referenced.
Authenticated users of Rocboss paopao-ce through 0.6.0-alpha.3 can obtain signed download URLs for other users' private, friend-only, and following-only media by requesting arbitrary content IDs from the /v1/attachment endpoint. Because post_content IDs are sequential, an ordinary registered low-privileged account (no administrative role required) is enough to enumerate IDs and harvest images, videos, and attachments belonging to other users, giving a high confidentiality impact with no write or availability effect. This is a genuine but bounded data-confidentiality issue rather than a critical infrastructure threat; no public exploit code was identified at time of analysis, although a public technical write-up describing the cross-user IDOR is referenced.