5 posts
Trigger.dev runs background jobs and AI agents for more than 30,000 developers. Its query API adds an organization filter to each table, but a table name in {braces} skipped it, so any API key could read the rows of all tenants. The fix shipped in 4.7.3, one day after my report.
Two FacturaScripts advisories, same product, same day. A path traversal in the mail attachment handler emails config.php to an attacker (CVSS 9.9). A Deploy endpoint signed with md5 of the database password lets anyone disable every plugin (CVSS 7.5). The first bug hands you the key to the second.
Notes from SkillBit's Flash CTF: seven challenges across forensics, reversing, web and misc. Six of them fell in a few minutes each, and the seventh taught me something, because my registry parser was a leaky abstraction over the evidence and it leaked silently.
Kimai locked its project report behind a permission check and left the export route beside it open. Any logged-in user could download customer names, project names, and budget metadata across every customer. Advisory GHSA-pvc4-crg3-gj44, CVE-2026-80194, patched in 2.64.0.
A ROLE_TEAMLEAD user in Kimai 2.56.0 could set systemAccount:true on their own profile through the user API and disappear from every billing report, every user dropdown, and every teammate's view. One missing permission check. Patched in 2.57.0, credit in the release notes.