MEDIUM6.5
GHSA-qgc9-p7cj-jvh6
FeehiCMS fails to enforce server-side immutability
Details
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/feehi/feehicms
No fixed version published yet for feehi/feehicms (composer). Pin to a known-safe version or switch to an alternative.