YosemiteCrew: Missing organization authorization on service and PMS library/template routes

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. authorizeCognito in apps/backend/src/middlewares/auth.ts sets the authenticated user's ID but does not provide the withOrgPermissions() and requirePermission(...) checks used by protected siblings. In apps/backend/src/routers/service.router.ts, PATCH /fhir/v1/service/:id and DELETE /fhir/v1/service/:id are authentication-only, while GET /fhir/v1/service/:id has no authentication middleware. The trace through apps/backend/src/controllers/web/service.controller.ts to apps/backend/src/services/service.service.ts passes a global record ID into ServiceModel.findById(oid) without an organisationId filter. In apps/backend/src/routers/task.router.ts, PUT /v1/task/pms/library/:libraryId, POST /v1/task/pms/templates, PATCH /v1/task/pms/templates/:templateId and DELETE /v1/task/pms/templates/:templateId likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…e-Crew/security/advisories/GHSA-256m-gg99-4274 Diğer

Kayıt geçmişi

1. 28 Eki 2026 18:36Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-116778FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
• 8,8 CVE-2026-56828Shopper: read-only team permissions allow administrator creation and permission escalation
• 5,4 CVE-2026-50542Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
• 4,3 CVE-2026-50543Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices
• 6,5 CVE-2026-50539Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments
• 6,5 CVE-2026-50541Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export