GHSA-v3qr-4v8m-29rh: ideon: Read-only project viewers can wipe and rewrite the canvas and tamper with blocks/files via role-unchecked project endpoints
ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/ resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. The most severe is POST /api/projects/[id]/graph, which deletes every block and link in the project and re-inserts client-supplied ones. A viewer can silently rewrite or wipe the entire canvas of a project they were invited to read. The application clearly intends viewer to be read-only: the collaborators endpoint, the automation endpoints, and the realtime Yjs sync path all reject write attempts from viewers. These specific HTTP handlers simply omit the guard their siblings enforce. This issue has been patched in version 0.9.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ideonto a version that resolves this vulnerability.Fixed in 0.9.4
Event History
Frequently Asked Questions
Who can exploit the issue?
A user who has been granted the read-only viewer role on a project can exploit the affected project mutation endpoints. The user does not need editor-level permissions for that project.
Which installations need to be remediated?
Ideon versions prior to 0.9.4 are affected. Version 0.9.4 contains the patch.
What is the most serious impact for an affected project?
A viewer can use the graph mutation endpoint to delete all blocks and links and replace them with attacker-supplied content. This can silently wipe or rewrite the project's canvas.
What should be done if affected projects contain untrusted viewers?
Upgrade to version 0.9.4. Until the upgrade is complete, removing read-only viewer access from untrusted users reduces exposure to the affected endpoints.