Medium 4.2

Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction

CVE-2025-71460 First seen on SecPulse 18:37

Summary

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files bel...

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
diced	dicedzipline	< 4.2.1→ 4.2.1	4.2.1

Original description The description as published by the source.

Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.

Source: CVE.org (CVE Program・cvelistV5) NVD

References

• advisory GitHub Security Advisory (GHSA-26wv-mhc3-5xfq)
• advisory VulnCheck Advisory: Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction