IDOR in Messages function in admidio/admidio

Valid

Reported on

Jun 9th 2022


Description

An user can view other users' private messages, join the conversation, delete messages if they know messages uuid

Proof of Concept

1. A send B a priavte messages/email
2. C can view messages, join the conversation, delete messages if C know messages uuid

Impact

This vulnerability is capable of leak private information, delete chats

We are processing your report and will contact the admidio team within 24 hours. 17 days ago
We have contacted a member of the admidio team and are waiting to hear back 16 days ago
We have sent a follow up to the admidio team. We will try again in 7 days. 13 days ago
Markus Faßbender validated this vulnerability 13 days ago
Andy has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Markus Faßbender gave praise 13 days ago
Thanks for researching this issue. I'm working on a fix and will release a new version soon.
The researcher's credibility has slightly increased as a result of the maintainer's thanks: +1
Markus Faßbender confirmed that a fix has been merged on 64c304 11 days ago
Markus Faßbender has been awarded the fix bounty
to join this conversation