Potpie
Monthly
Missing ownership verification in potpie through 2.0.0 allows authenticated users to inject arbitrary file changes into other users' conversations via the POST /conversations/{conversation_id}/code-changes/sync endpoint. Because the API never checks that the requesting user owns the supplied conversation_id, any authenticated account can overwrite pending code-change state in conversations belonging to other users-an Insecure Direct Object Reference (IDOR) pattern classified as CWE-862. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability is straightforward to exploit given valid authentication and knowledge of a target conversation ID.
Missing ownership verification in potpie through 2.0.0 allows authenticated users to inject arbitrary file changes into other users' conversations via the POST /conversations/{conversation_id}/code-changes/sync endpoint. Because the API never checks that the requesting user owns the supplied conversation_id, any authenticated account can overwrite pending code-change state in conversations belonging to other users-an Insecure Direct Object Reference (IDOR) pattern classified as CWE-862. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability is straightforward to exploit given valid authentication and knowledge of a target conversation ID.