Snippet Content Disclosure via Query Metadata Template Tags

Summary

An authenticated user can view any code saved to a snippet via a snippet-id template tag, even if that user lacks permissions to the snippet. Snippet content can potentially expose sensitive SQL logic or internal schema details.

Details

The metadata-resolution path for native queries dereferenced a caller-supplied snippet identifier in template tags and attached the corresponding snippet content to its response. Read authorization on the snippet itself wasn’t evaluated during that lookup.

The exposure is limited to the stored text of the snippet and doesn’t directly return data from an underlying database (though the snippet text may reveal schema details, embedded literals, or query logic).

The fix adds a permission check so that metadata lookups only return snippet content the requesting user is allowed to read.

Patches

The fix is available in the following versions and above:

• 1.54.23, 0.54.23
• 1.55.23, 0.55.23
• 1.56.23, 0.56.23
• 1.57.17, 0.57.17
• 1.58.12, 0.58.12
• 1.59.6, 0.59.6
• 1.60.1, 0.60.1

Credit

Reported by Aikido Security — Jorian Woltjer, Rein Daelman, Robbe Verwilghen.