PT-2026-99101

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.3 Description An issue exists in the URLValidator.validateURL function where DNS hostnames are not properly resolved and internal addresses are not correctly validated. This allows users with permissions to...

Shopify: Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events

By registering to a few different Shopify Ping Websocket Events on the wss://argus.shopifycloud.com/graphql?shopid=id endpoint, a staff without any permission can listen to conversions with customers. Steps to reproduce 1. With a staff that doesn't have any permissions, login into the shop admin ...