Description
Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | 0 <4.2.1 | — |