https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:26:40 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-53930 cnvd-2021-53930 https://cve.radiocsirt.org/vuln/cnvd-2021-53930 https://cve.radiocsirt.org/vuln/euvd-2026-28074 EUVD-2026-28074 https://cve.radiocsirt.org/vuln/euvd-2026-28074 https://cve.radiocsirt.org/vuln/fkie_cve-2021-32691 <p>Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone&#39;s account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one&#39;s server by overriding the `create` data source method on the `People` class.</p> <p>Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone&#39;s account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one&#39;s server by overriding the `create` data source method on the `People` class.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-32691 https://cve.radiocsirt.org/vuln/ghsa-r578-pj6f-r4ff <p><strong>Affected:</strong> npm: @apollosproject/data-connector-rock</p> <p>### Impact</p> <p>New user registrations are able to access anyone&#39;s account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events).</p> <p>### Patches</p> <p>We have released a security patch on v2.20.0. The solution was to create a duplicate person and then patch the new person with their profile details.</p> <p>### Workarounds</p> <p>If you do not wish to upgrade your app to the new version, you can patch your server by overriding the `create` data source method on the `People` class.</p> <p>```js create = async (profile) =&gt; { const rockUpdateFields = this.mapApollosFieldsToRock(profile); // auto-merge functionality is compromised // we are creating a new user and patching them with profile details const id = await this.post(&#39;/People&#39;, { Gender: 0, // required by Rock. Listed first so it can be overridden. IsSystem: false, // required by rock }); await this.patch(`/People/${id}`, { ...rockUpdateFields, }); return id; }; ```</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [support@apollos.app](mailto:support@apollos.app)</p> <p><strong>Affected:</strong> npm: @apollosproject/data-connector-rock</p> <p>### Impact</p> <p>New user registrations are able to access anyone&#39;s account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events).</p> <p>### Patches</p> <p>We have released a security patch on v2.20.0. The solution was to create a duplicate person and then patch the new person with their profile details.</p> <p>### Workarounds</p> <p>If you do not wish to upgrade your app to the new version, you can patch your server by overriding the `create` data source method on the `People` class.</p> <p>```js create = async (profile) =&gt; { const rockUpdateFields = this.mapApollosFieldsToRock(profile); // auto-merge functionality is compromised // we are creating a new user and patching them with profile details const id = await this.post(&#39;/People&#39;, { Gender: 0, // required by Rock. Listed first so it can be overridden. IsSystem: false, // required by rock }); await this.patch(`/People/${id}`, { ...rockUpdateFields, }); return id; }; ```</p> <p>### For more information If you have any questions or comments about this advisory: * Email us at [support@apollos.app](mailto:support@apollos.app)</p> https://cve.radiocsirt.org/vuln/ghsa-r578-pj6f-r4ff https://cve.radiocsirt.org/vuln/gsd-2021-32691 gsd-2021-32691 https://cve.radiocsirt.org/vuln/gsd-2021-32691