Description
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Swetrix swetrix
Default version status: unaffected
0 to < 5.1.0affected
References
- https://github.com/Swetrix/swetrix/issues/477 ↗
- https://github.com/Swetrix/swetrix/blob/v5.0.3/backend/apps/cloud/src/project/project.controller.ts#L888-L920 ↗
- https://github.com/Swetrix/swetrix/commit/63eb76edcb446402ad1db5ff870920773f5ff588 ↗
- https://github.com/Swetrix/swetrix/releases/tag/v5.1.0 ↗
- https://www.vulncheck.com/advisories/swetrix-cloud-before-5.1.0-missing-authorization-via-post-project-organisation-orgid ↗