GHSA-cjgj-2fwf-4c2w
Perses's project query parameter authorization bypass exposes cross-project resources
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/perses/perses | < 0.54.0-beta.3 | 0.54.0-beta.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
_What kind of vulnerability is it?_
An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.
_Who is impacted?_
Any authenticated user reads every project's dashboards, datasources, variables across tenants.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
### Workarounds
None
References
External links from the advisory. They lead to third-party sites.