Skip to content

#Security: Topic collection not filtered against current user #433

@derwok

Description

@derwok

The topic collection server publish needs a filter by user. Otherwise it would be possible to see other users topics in the console.

Though this is a security issue. It is considered a minor risk for two reasons:
1.) the curious attacker would need an existing meeting series ID, which is not easyily guessable. Nevertheless users that where once invited and are not invited currently could use the old MS id to get access to topics
2.) The access is not via UI, but you need JS console to gain access

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions