Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for the requested project ID. An authenticated attacker can send a malicious request containing another user's project ID to unlawfully modify, delete, or manipulate tags on that project, which can severely compromise data integrity and availability.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Onlook 安全漏洞
Vulnerability Description
Onlook是Onlook开源的一个源码可视化编辑工具。 Onlook 0.2.32版本存在安全漏洞，该漏洞源于API未验证当前认证用户对请求项目ID的所有权或成员资格，可能导致数据完整性和可用性受损。
CVSS Information
N/A
Vulnerability Type
N/A