CVE-2024-10953
data.all authenticated users can perform mutating update operations on persisted notification records
Summary
data.all authenticated users can perform mutating update operations on persisted notification records
Original description
The description as published by the source.
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory aws.amazon.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com