Vulnerability GHSA-cjgj-2fwf-4c2w
Summary
Perses's project query parameter authorization bypass exposes cross-project resources
Details
Impact
What kind of vulnerability is it?
An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.
Who is impacted?
Any authenticated user reads every project's dashboards, datasources, variables across tenants.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
None
Related Vulnerabilities
Other vulnerabilities affecting the same packages
