Description
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| obot-platform | obot | 0.25.0 – < 0.25.6, 0.26.0 – < 0.26.1 | 0.25.6 |
References
- Patch Commit patch
- https://github.com/obot-platform/obot product
- GitHub Security Advisory (GHSA-929v-v9hq-5xhr) vendor-advisory
- https://github.com/obot-platform/obot/commit/09e4d5b5d1e4a5f35a6cbcff96f3c460c3f9e278 patch
- obot v0.26.1 Release Notes release-notes
- https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/group.go#L652-L734 technical-description
- https://github.com/obot-platform/obot/blob/2d2aaca9dc9b26777f8a2d213e0e1ec47f47508e/pkg/gateway/client/identity.go#L444-L456 technical-description
- https://github.com/obot-platform/obot/blob/6f81dac8d344cf6b2161f500460fb7b2a975c415/pkg/gateway/client/group.go#L741-L757 technical-description
- VulnCheck Advisory: Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership third-party-advisory