GHSA-8p2f-fx4q-75cx
Suggest an improvement- Source
- https://github.com/advisories/GHSA-8p2f-fx4q-75cx
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-8p2f-fx4q-75cx/GHSA-8p2f-fx4q-75cx.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-8p2f-fx4q-75cx
- Aliases
- Related
- Published
- 2025-08-22T16:49:55Z
- Modified
- 2025-08-22T21:54:52.586395Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- UnoPim has Broken Access Control
- Details
-
Summary
In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.
Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption
Affected Behavior
Single delete (enforced): DELETE
/admin/catalog/products/{id}returns 401 with "This action is unauthorized" for users lacking the Delete privilege.Mass delete (not enforced): POST
/admin/catalog/products/mass-deleteallows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.PoC
A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.
Impact
Unauthorized product deletion -> data loss, possible business disruption
- Database specific
{ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-08-22T16:49:55Z", "nvd_published_at": "2025-08-22T16:15:46Z", "cwe_ids": [ "CWE-284", "CWE-862" ] }- References
-
- https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx
- https://nvd.nist.gov/vuln/detail/CVE-2025-55741
- https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989
- https://github.com/unopim/unopim/commit/f49fa630afd36ff61c146b3e5bc7a0808667ca19
- https://github.com/unopim/unopim
- https://www.youtube.com/watch?v=J_WV8fCXlJM
- https://youtu.be/J_WV8fCXlJM
Affected packages
Packagist / unopim/unopim
Package
- Name
- unopim/unopim
- Purl
- pkg:composer/unopim/unopim