Cyber

What changed

The Joomlack Page Builder, specifically versions prior to 3.6.0, has been found to contain an improper access control vulnerability. This flaw allows unauthenticated users to upload files without restriction, which can lead to the execution of arbitrary code on the server.

Who is affected

The vulnerability impacts users of the Joomlack Page Builder extension for Joomla, particularly those running versions below 3.6.0. Organizations utilizing this extension should be aware of the potential risks associated with this flaw.

• Joomla users employing the Page Builder CK extension.
• Websites built on Joomla that have not updated to version 3.6.0 or later.
• Developers and administrators managing Joomla extensions.

What to do

It is crucial for affected users to take immediate action to mitigate the risk posed by this vulnerability. Upgrading to the latest version of the Page Builder CK extension is strongly recommended.

• Update the Page Builder CK extension to version 3.6.0 or later.
• Review server logs for any unauthorized file uploads.
• Implement additional security measures to restrict file uploads and monitor for unusual activity.

What changed

Langflow has released an important update to address a critical authorization bypass vulnerability. This flaw, identified as an Insecure Direct Object Reference (IDOR), existed in the /api/v1/responses endpoint, allowing authenticated attackers to manipulate flow IDs and access flows belonging to other users.

The vulnerability has been fixed in version 1.9.1, ensuring that user flows are protected against unauthorized access.

Who is affected

Organizations using Langflow prior to version 1.9.1 are at risk of this vulnerability, particularly those leveraging AI-powered agents and workflows.

Any authenticated user of Langflow could potentially exploit this flaw to access sensitive workflows belonging to other users.

• Langflow users operating versions before 1.9.1.
• Organizations deploying AI workflows through Langflow.
• Developers utilizing Langflow for building AI agents.

What to do

It is crucial for all users of Langflow to upgrade to version 1.9.1 immediately to mitigate the risk posed by this vulnerability. Regularly updating software and monitoring for security advisories can help maintain a secure environment.

Additionally, organizations should review their access controls and user permissions to ensure that unauthorized access is minimized.

• Upgrade Langflow to version 1.9.1 or later.
• Review and tighten access controls for user flows.
• Monitor for any suspicious activity related to flow access.