EdgeEver Missing Authorization in Hono API Memo-Template Routes

Executive Summary

EdgeEver through 1.108.0 has a missing authorization vulnerability in the Hono API memo-template routes. This flaw allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos privileges can save a template and use POST /api/v1/templates/:id/use to create memos, or list, modify, or delete templates in the token owner's workspace.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized template usage by reviewing API logs for POST /api/v1/templates/:id/use requests from tokens lacking write:memos scope. Inspect template modifications or deletions in user workspaces without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

If you use EdgeEver with scoped API tokens, an attacker with a token lacking write:memos permissions could exploit this to create, modify, or delete memos and templates in your workspace. This could lead to unauthorized data manipulation or exposure within your account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if unauthorized changes occur to sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Update EdgeEver to the latest version where requireScopes is properly enforced in template handlers. Review and revoke any compromised API tokens. Monitor for unusual template activities in user workspaces.

Useful 0 Not Useful 0