pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

SummarySeveral WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model.Confirmed mismatches:- ADD user can reorder packages/files...

PT-2022-26149 · Fastify · Fastify

Name of the Vulnerable Software and Affected Versions: Fastify versions prior to 3.29.4 Fastify versions prior to 4.10.2 Description: The issue allows an attacker to bypass the Pre-Flight checking of fetch by using an incorrect Content-Type. This could potentially be used to invoke routes that on...