~ / search / GHSA-v4gp-hf5j-4566

GHSA-v4gp-hf5j-4566

IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users

Source: GitHub Advisory Database (reviewed) High CVE-2025-67796

Packages

EcosystemPackageAffectedFixed in
PyPI rdiffweb < 2.10.6 2.10.6

Details

As written in the advisory (Markdown source, shown as plain text).

IKUS Rdiffweb version 2.10.5 and below have an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6.

References

External links from the advisory. They lead to third-party sites.