POC详情： 0e376e9b69d59ada79397a5d6e6d87b359a9a86a

描述

The Tolgee API exposes the `/v2/pats` endpoint without requiring authentication, allowing attackers to create Personal Access Tokens (PATs). These tokens can then be leveraged to interact with the API and gain elevated privileges.

文件快照

 id: tolgee-api-anonymous

info:
  name: Tolgee API - Misconfiguration Anonymous Access
  author: mat

...

备注