The WebAuthn login flow never persists the challenge it issues, so
the replay guard never runs. An attacker who captures a valid
assertion can replay it to authenticate as the victim.
The brute-force throttle protecting the administration two-factor
prompt is scoped to the session. An attacker who starts with a fresh
cookie jar resets the counter and can guess TOTP codes without any
effective rate limit.
An LDAP login silently reactivates a local account that an
administrator has blocked, and the state change is not written to the
audit log, so a revoked user regains access unnoticed.
The remember-me cookie is issued before the second factor has been
verified. An attacker who knows only the password can keep the cookie
from the incomplete login and use it to return as the fully
authenticated user, bypassing two-factor authentication.
Glossary input is escaped before it is truncated. Truncation can cut
an escape sequence in half, which allows an authenticated user to
inject SQL into the resulting query.
A tracking file below the document root is served without
authentication and contains password reset tokens, allowing an
unauthenticated visitor to take over the accounts those tokens belong
to.
The public PDF export does not check whether a FAQ record is active,
so an unauthenticated visitor can retrieve the title and solution of
drafts and unpublished entries.
Comment endpoints do not verify authorization for the parent FAQ
record, exposing the comments, the personal data of the commenters,
and attachment metadata of restricted records.
The PostgreSQL search backend declares the wrong LIKE ESCAPE
character, which makes the wildcard-escaping fix ineffective on that
backend.
The administration API endpoints that read the LDAP, Elasticsearch,
OpenSearcr, and dashboard configuration only require a login instead
of the CONFIGURATION_EDIT permission, so any authenticated user can
read these settings.
An authenticated FAQ editor can reference a local file as an image in
a FAQ entry and have the PDF export embed and disclose its contents.
The registration endpoints remain reachable even when
security.enableRegistration is turned off, so visitors can still create
accounts on an installation that is meant to be closed.
The content backup is written as a ZIP archive into the web-accessible
document root, where anyone who guesses or learns its name can download
the full contents of the installation.
The backup, database migration, and maintenance mode endpoints can be
reached without authentication, allowing an unauthenticated attacker
to export data or put the installation into maintenance mode.