Authorization Bypass in Steedos Platform via ObjectQL

Executive Summary

Steedos Platform through version 3.0.15-beta.51 has an authorization bypass flaw. Authenticated users can exploit it to read report definitions belonging to other tenants by querying the reports object. The issue occurs because objectql's callAdapter skips space filtering for enable_space_global objects during find/findOne operations, allowing unauthorized access to sensitive report details.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if authenticated users can query the /api/v1/reports endpoint and access report definitions belonging to other tenants. Monitor API logs for unauthorized GET requests to this endpoint. Verify if objectql's callAdapter is skipping space filtering for enable_space_global objects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with valid credentials to access other tenants' report names, descriptions, and object/field API names. This could lead to data leaks, competitive espionage, or further exploitation if combined with other vulnerabilities. The impact is limited to information disclosure, not direct data modification or deletion.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive tenant data. GDPR requires strict access controls and data segregation, while HIPAA mandates safeguards for protected health information. The flaw undermines compliance by allowing cross-tenant data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Steedos Platform to version 3.0.15-beta.51 or later. Restrict access to the /api/v1/reports endpoint to authorized users only. Implement strict tenant isolation to prevent unauthorized data access. Review and audit API logs for suspicious activity related to report queries.

Useful 0 Not Useful 0