https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 19:39:54 +0000 https://cve.radiocsirt.org/vuln/cnvd-2023-07920 cnvd-2023-07920 https://cve.radiocsirt.org/vuln/cnvd-2023-07920 https://cve.radiocsirt.org/vuln/euvd-2026-225482 EUVD-2026-225482 https://cve.radiocsirt.org/vuln/euvd-2026-225482 https://cve.radiocsirt.org/vuln/fkie_cve-2023-0610 <p>Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.</p> <p>Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-0610 https://cve.radiocsirt.org/vuln/ghsa-mrqx-mjc4-vfh3 <p><strong>Affected:</strong> Packagist: wallabag/wallabag</p> <p>### Impact The annotations feature lets users add annotations on highlighted parts of an entry.</p> <p>The controller does not validate authorization on `PUT` and `DELETE` requests which lets a logged user modify or delete any annotation using their ID on their endpoints `example.org/annotations/{id}`.</p> <p>These vulnerable requests also disclose highlighted parts of the entry to the attacker.</p> <p>You should immediately patch your instance to version 2.5.3 or higher if you have more than one user and/or having open registration.</p> <p>### Resolution</p> <p>A user check is now done in the vulnerable methods before applying change on an annotation.</p> <p>The Annotation retrieval through a `ParamConverter` has also been replaced with a call to the `AnnotationRepository` in order to prevent any information disclosure through response discrepancy.</p> <p>### Workarounds</p> <p>### Credits</p> <p>We would like to thank @bAuh0lz for reporting this issue through huntr.dev.</p> <p>Reference: https://huntr.dev/bounties/8fdd9b31-d89b-4bbe-9557-20b960faf926/</p> <p><strong>Affected:</strong> Packagist: wallabag/wallabag</p> <p>### Impact The annotations feature lets users add annotations on highlighted parts of an entry.</p> <p>The controller does not validate authorization on `PUT` and `DELETE` requests which lets a logged user modify or delete any annotation using their ID on their endpoints `example.org/annotations/{id}`.</p> <p>These vulnerable requests also disclose highlighted parts of the entry to the attacker.</p> <p>You should immediately patch your instance to version 2.5.3 or higher if you have more than one user and/or having open registration.</p> <p>### Resolution</p> <p>A user check is now done in the vulnerable methods before applying change on an annotation.</p> <p>The Annotation retrieval through a `ParamConverter` has also been replaced with a call to the `AnnotationRepository` in order to prevent any information disclosure through response discrepancy.</p> <p>### Workarounds</p> <p>### Credits</p> <p>We would like to thank @bAuh0lz for reporting this issue through huntr.dev.</p> <p>Reference: https://huntr.dev/bounties/8fdd9b31-d89b-4bbe-9557-20b960faf926/</p> https://cve.radiocsirt.org/vuln/ghsa-mrqx-mjc4-vfh3 https://cve.radiocsirt.org/vuln/gsd-2023-0610 gsd-2023-0610 https://cve.radiocsirt.org/vuln/gsd-2023-0610