Description
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a template and invoke POST /api/v1/templates/:id/use to create memos, and list, modify, or delete templates in the token owner's workspace.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
tianma-if EdgeEver
Default version status: unaffected
0 to ≤ 1.108.0affected
pkg:github/tianma-if/edgeeverReferences
- https://hackmd.io/@haind/edgeever-template-write-memos-scope-bypass ↗
- https://github.com/tianma-if/edgeever/blob/0ef9a1df9c849a64047aba64c70331c2badf8b39/apps/api/src/template-routes.ts#L116-L230 ↗
- https://github.com/tianma-if/edgeever/blob/0ef9a1df9c849a64047aba64c70331c2badf8b39/apps/api/src/memo-routes.ts#L148-L150 ↗
- https://github.com/tianma-if/edgeever ↗
- https://www.vulncheck.com/advisories/edgeever-through-1.108.0-missing-authorization-via-memo-template-api-routes ↗