Description
Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Parabol | Parabol | < 15.21.2 | 15.21.2 |
References
- https://github.com/ParabolInc/parabol/issues/13727 issue-tracking
- https://github.com/ParabolInc/parabol/commit/1f063b2f2768ad3a6138156ddce9d938f58e8005 patch
- Parabol v15.21.2 Release Notes release-notes
- https://github.com/ParabolInc/parabol/blob/v15.21.1/packages/server/graphql/public/mutations/addReactjiToReactable.ts#L36-L99 technical-description
- https://hackmd.io/@hieuPenguinnn/parabol-addreactjitoreactable-cross-meeting-idor third-party-advisory
- VulnCheck Advisory: Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation third-party-advisory