CVE-2023-40020

CVE-2023-40020 affects PrivateUploader (Vue/TypeScript image hosting server). In affected versions the route at app/routes/v3/admin.controller.ts did not properly verify whether a user was an administrator or moderator, causing the request to continue processing after a 403 ADMIN_ONLY response. A...

CVE-2023-40020 Improper Authentication in PrivateUploader

PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions app/routes/v3/admin.controller.ts did not correctly verify whether the user was an administrator High Level or moderator Low Level causing the request to continue processing. The response...

PrivateUploader License Issue Vulnerability

PrivateUploader is the ultimate open source image uploader and file storage solution. An authorization issue vulnerability exists in versions prior to PrivateUploader 3.2.49, which stems from not properly validating whether a user is an administrator high level or a moderator low level, causing...