CVE-2024-6303 Missing Authorization in Conduit

Missing authorization in Client-Server API in Conduit =0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the...

CVE-2024-6303

CVE-2024-6303 describes a missing authorization flaw in Conduit before or equal to version 0.7.0 in the Client-Server API. The vulnerability allows an attacker to remove and add any alias to a room, enabling privilege escalation by moving the #admins alias to a room under attacker control. This c...

PT-2024-37525 · Conduit · Conduit

Name of the Vulnerable Software and Affected Versions: Conduit versions prior to 0.7.0 Description: The issue concerns missing authorization in the Client-Server API, allowing for unauthorized removal and addition of aliases to different rooms. This can be exploited for privilege escalation by...