GHSA-cjgj-2fwf-4c2w
Perses's project query parameter authorization bypass exposes cross-project resources
Quick fix
GHSA-cjgj-2fwf-4c2w — github.com/perses/perses: upgrade to the fixed version with the command below.
go get github.com/perses/perses@v0.54.0-beta.3Details
### Impact _What kind of vulnerability is it?_
An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.
_Who is impacted?_
Any authenticated user reads every project's dashboards, datasources, variables across tenants.
### Patches _Has the problem been patched? What versions should users upgrade to?_
### Workarounds None
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 0.54.0-beta.3go get github.com/perses/perses@v0.54.0-beta.3