CVE-2024-55070

The hay-kot mealie recipe manager (version v2.2.0 ) contains a Broken Object Level Authorization vulnerability within the /households/permissions component. This flaw allows group managers to unauthorizedly edit their own permissions. To mitigate this risk until a formal patch is available, it is...

CVE-2024-55072

The hay-kot mealie recipe manager (v2.2.0) contains a Broken Object Level Authorization vulnerability in the /api/users/{user-id} component. This flaw allows users to edit their own profiles to escalate privileges or modify their household information. A proof-of-concept was published on 2025-03-...

PT-2025-13392

Name of the Vulnerable Software and Affected Versions hay-kot mealie version 2.2.0 Description A Broken Object Level Authorization issue exists in the "/api/users/user-id" component, allowing users to modify their own profiles and potentially grant themselves additional permissions or change thei...

Broken Object Level Authorization

Indico is vulnerable to a Broken Object Level Authorization BOLA vulnerability. The vulnerability is due to insufficient access control in the /api/principals component, which allows attackers to retrieve information about other user accounts by sending crafted POST requests...

GHSA-3WG7-R7Q5-R2JF Indico Insecure Access

A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals...

Indico Insecure Access

A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals...

CVE-2024-50633

A Broken Object Level Authorization BOLA vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain...

CVE-2024-50633

A Broken Object Level Authorization BOLA vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain...

CVE-2024-50633

A Broken Object Level Authorization BOLA vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain...

CVE-2024-12305

Unifiedtransform v2.0 (and potentially earlier) contains an object‑level access control flaw in MarkController.php that lets a student access other students’ grades by altering the student_id parameter in the marks viewing endpoint. The CVE description explicitly notes insufficient access checks ...

Unifiedtransform security vulnerability

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0 and prior versions that stems from an object-level access control vulnerability allowing unauthorized access to student grades...

CVE-2024-12306: Improper Access Control

Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level...

PT-2024-17535

Name of the Vulnerable Software and Affected Versions Unifiedtransform versions 2.0 and earlier Description An object-level access control issue allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student id parameter in the...

Understanding the OWASP API Security Top 10: Why BOLA is the Number One Risk for APIs

Understanding and addressing vulnerabilities is critical in cybersecurity, where APIs serve as the backbone for seamless data exchange. The OWASP API Security Top 10, revised in 2023, provides a comprehensive guide to the critical issues that organizations must tackle to ensure the robust securit...

Nautobot missing object-level permissions enforcement when running Job Buttons

Impact When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have permission to run Jobs in general?. Object-level permissions i.e., does the user have permission to run this specific Job? are not enforced by the URL/view used ...

Code injection

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

PYSEC-2023-287

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

CVE-2023-51649 Nautobot missing object-level permissions enforcement when running Job Buttons

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

CVE-2023-51649

CVE-2023-51649 affects Nautobot, a Django-based network automation platform. The issue: when submitting a Job via a Job Button, only the model-level extras.run_job permission is enforced; object-level permissions (permission to run a specific Job) are not checked by the relevant URL/view. Result:...

CVE-2023-51649

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level "extras.runjob" permission is checked i.e., does the user have...