Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go reads the workspace UUID from the path…
Medium CVSS 4.3
Summary
Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for GET /a/share/cell/{Uuid} loads the workspace and requires MatchPolicies with ResourcePolicyAction_READ, returning a not-found error so that existence is not disclosed. Nothing compensates further down…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/pydio/cells
- https://github.com/pydio/cells/blob/v5.0.2/common/proto/service/converter.go#L35-L38
- https://github.com/pydio/cells/blob/v5.0.2/frontend/web/public-handler.go#L167
- https://github.com/pydio/cells/blob/v5.0.2/idm/share/rest/handler.go#L133-L158
- https://github.com/pydio/cells/blob/v5.0.2/idm/share/rest/handler.go#L193-L203
- https://github.com/pydio/cells/issues/981
- https://www.vulncheck.com/advisories/pydio-cells-to-missing-authorization-on-the-share-link-rest-handler
Timeline
- nvd_ingest NVD