Tamery
Monthly
An authorization bypass in Tamery (formerly Conar) cloud sync lets an authenticated Pro subscriber write messages into another user's AI chat history by supplying a victim's chatId to the chatsMessages.update handler, which never verifies that the caller owns the chat. Versions 0.26.1 through 0.98.x are affected, and the flaw is an integrity-only primitive (CVSS 4.0: 5.3 medium; independently assessed CVSS 3.1: 5.3, VC:N/VI:L/VA:N) that grants no read access to victim data. A public technical writeup describing the cross-user write exists; it is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation was provided. Fix is available in 0.99.0.
Broken object ownership enforcement in Tamery's cloud sync API lets an authenticated user who owns at least one connection attach attacker-named resource rows to another user's connection, so the injected rows appear in the victim's client. Tamery (formerly Conar) releases from 0.32.0 up to but not including 0.99.0 are affected; the flaw is integrity-only, granting no read access to victim data and no availability impact, and requires valid credentials plus knowledge of the victim's connectionId. No public exploit code has been confirmed - a public technical writeup (HackMD) describing the issue exists - and vendor fixes are available in 0.99.0; priority is this_month, not emergency.
An authorization bypass in Tamery (formerly Conar) cloud sync lets an authenticated Pro subscriber write messages into another user's AI chat history by supplying a victim's chatId to the chatsMessages.update handler, which never verifies that the caller owns the chat. Versions 0.26.1 through 0.98.x are affected, and the flaw is an integrity-only primitive (CVSS 4.0: 5.3 medium; independently assessed CVSS 3.1: 5.3, VC:N/VI:L/VA:N) that grants no read access to victim data. A public technical writeup describing the cross-user write exists; it is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation was provided. Fix is available in 0.99.0.
Broken object ownership enforcement in Tamery's cloud sync API lets an authenticated user who owns at least one connection attach attacker-named resource rows to another user's connection, so the injected rows appear in the victim's client. Tamery (formerly Conar) releases from 0.32.0 up to but not including 0.99.0 are affected; the flaw is integrity-only, granting no read access to victim data and no availability impact, and requires valid credentials plus knowledge of the victim's connectionId. No public exploit code has been confirmed - a public technical writeup (HackMD) describing the issue exists - and vendor fixes are available in 0.99.0; priority is this_month, not emergency.