6 matches found
CVE-2026-119598
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...
EUVD-2026-113935
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...
CVE-2026-119598
Miaomiaowu versions prior to 0.9.3 are vulnerable to an insecure direct object reference (IDOR) vulnerability in the /api/user/proxy-provider-configs endpoint. An authenticated user can exploit this by iterating the global auto-increment external_subscription_id parameter to access configurations...
CVE-2026-119598 Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...
PT-2026-133550
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment external subscription id parameter to disclose override...
CVE-2026-92750 Harness through 3.3.0 Missing Access Control via infraproviders endpoint
Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...