Description
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| metasfresh | metasfresh | — | — |
References
- GitHub Issue #24665 issue-tracking
- https://github.com/metasfresh/metasfresh product
- attachment endpoints stop at assertLoggedIn with no record-level check technical-description
- ImageRestController applies the checkCanView guard the attachment controller omits technical-description
- VulnCheck Advisory: metasfresh Unauthorized Access via Document Attachments and Comments Endpoints third-party-advisory