Improper Authorization of Index Containing Sensitive Information
CWE-612
The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8.
Latest Improper Authorization of Index Containing Sensitive Information vulnerabilities
- 8.2 High severity
Smart Pet Feeder Platform: Improper Authorization of Index Containing Sensitive Information
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/det
- 9.8 Critical severity
Smart Pet Feeder Platform: Improper Authorization of Index Containing Sensitive Information
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers can retrieve device serial numbers and MAC
- 9.8 Critical severity
Smart Pet Feeder Platform: Improper Authorization of Index Containing Sensitive Information
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by accepting arbitrary serial numbers without ownership verification. Attackers can control any device by se
- 8.8 High severity
alf.io: Improper Authorization of Index Containing Sensitive Information
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes
- 7.5 High severity
security: Improper Authorization of Index Containing Sensitive Information
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured w