Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username

Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username

The product does not have sufficient logical or access checks when updating a user's information. This could result in an attacker being able to escalate privileges for themselves or others. When uploading organism or sequence data via the web interface, the application will unzip and inspect the files and will not check for path traversal in supported archive types. Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username After attempting to upload a file that does not meet pre-requisites, GMOD Apollo will respond with local path information disclosure