Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/400a9001a661e5ab2f87c51de25da1c4afa7ceed Yama
• github.com/wannabespace/tamery/issues/601 Üçüncü taraf
• hackmd.io/…guinnn/conar-broken-ownership-cross-user-write Üçüncü taraf
• vulncheck.com/…-authorization-via-connectionsresources-create Üçüncü taraf
• github.com/…i/orpc/routers/connections-resources/create.ts Diğer
• github.com/wannabespace/tamery Diğer

Kayıt geçmişi

1. 30 Eki 2026 17:16Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-119664Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update
• 6,5 CVE-2026-119708abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name
• 8,5 CVE-2026-61708SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)
• 4,2 CVE-2026-119661ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
• 5,4 CVE-2026-119659Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
• 5,0 CVE-2026-119657FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations