https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 14:23:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-10424 EUVD-2026-10424 https://cve.radiocsirt.org/vuln/euvd-2026-10424 https://cve.radiocsirt.org/vuln/fkie_cve-2023-50448 <p>In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.</p> <p>In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-50448 https://cve.radiocsirt.org/vuln/ghsa-356j-hg45-x525 <p><strong>Affected:</strong> RubyGems: activeadmin</p> <p>### Impact</p> <p>In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user.</p> <p>The bug affects the functionality to export data as CSV files, and was caused by a variable holding the collection to be exported being shared across threads and not properly synchronized.</p> <p>The attacker would need access to the same ActiveAdmin application as the victim, and could exploit the issue by timing their request immediately before when they know someone else will request a CSV (e.g. via phishing) or request CSVs frequently and hope someone else makes a concurrent request.</p> <p>### Patches</p> <p>Versions 2.12.0 and above fixed the problem by completely removing the shared state.</p> <p><strong>Affected:</strong> RubyGems: activeadmin</p> <p>### Impact</p> <p>In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user.</p> <p>The bug affects the functionality to export data as CSV files, and was caused by a variable holding the collection to be exported being shared across threads and not properly synchronized.</p> <p>The attacker would need access to the same ActiveAdmin application as the victim, and could exploit the issue by timing their request immediately before when they know someone else will request a CSV (e.g. via phishing) or request CSVs frequently and hope someone else makes a concurrent request.</p> <p>### Patches</p> <p>Versions 2.12.0 and above fixed the problem by completely removing the shared state.</p> https://cve.radiocsirt.org/vuln/ghsa-356j-hg45-x525 https://cve.radiocsirt.org/vuln/gsd-2023-50448 gsd-2023-50448 https://cve.radiocsirt.org/vuln/gsd-2023-50448