GHSA-qcqv-38jg-2r43
Pageflow vulnerable to insecure direct object reference in membership update endpoint
GHSA-qcqv-38jg-2r43 is a vulnerability with no CVSS score yet in pageflow, published September 15, 2022. No source lists public exploit code. Fixed in pageflow 14.5.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
14.5.2pageflow +3 more
Description
Impact
Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to (including their own). While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending arbitrary HTTP request to craft a request to the /admin/users/{user_id}/memberships/{membership_id} endpoint containing an additional membership[entity_id] parameter. This parameter is honored when the membership is updated, allowing an attacker to update the membership object associated with their own account (with manager role) to be associated with a different attacker-chosen account instead. Since account_ids are enumerable, an attacker can compromise all accounts present on the platform.
Mitigation
Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem.
For more information
If you have any questions or comments about this advisory email us at info(at)codevise.de
Credits
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pageflowRubyGems | before 14.5.2 | 14.5.2 |
pageflowRubyGems | 15.0.0 up to 15.7.1 | 15.7.1 |
pageflowRubyGems | before 14.5.2, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 45 moreShow less0.1.00.10.00.11.00.11.10.11.20.11.30.11.40.2.00.2.10.3.00.4.00.5.00.6.00.7.00.7.10.7.20.8.00.8.10.8.20.9.00.9.10.9.212.0.012.0.0.rc112.0.0.rc212.0.0.rc312.0.0.rc412.0.0.rc512.0.0.rc612.0.0.rc712.0.112.0.212.0.312.0.412.1.012.2.012.3.012.4.012.4.112.5.012.6.013.0.013.0.0.beta113.0.0.beta213.0.0.beta3 | 14.5.2 |
pageflowRubyGems | 15.0.0 up to 15.7.1, plus listed versions 15.0.115.0.215.1.015.1.0.beta115.1.0.beta2 Show 16 moreShow less15.1.0.beta315.1.0.beta415.1.0.beta515.1.0.beta615.1.0.rc015.1.115.1.215.2.015.2.115.2.215.3.015.4.015.5.015.6.015.6.115.7.0 | 15.7.1 |
What each source reports
GitHub AdvisoriesNo score
Pageflow vulnerable to insecure direct object reference in membership update endpoint
Impact
Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to (including their own). While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending arbitrary HTTP request to craft a request to the /admin/users/{user_id}/memberships/{membership_id} endpoint containing an additional membership[entity_id] parameter. This parameter is honored when the membership is updated, allowing an attacker to update the membership object associated with their own account (with manager role) to be associated with a different attacker-chosen account instead. Since account_ids are enumerable, an attacker can compromise all accounts present on the platform.
Mitigation
Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem.
For more information
If you have any questions or comments about this advisory email us at info(at)codevise.de
Credits
- Record
GHSA-qcqv-38jg-2r43- Updated
- 2026-11-02
OSVNo score
Pageflow vulnerable to insecure direct object reference in membership update endpoint
Impact
Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to (including their own). While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending arbitrary HTTP request to craft a request to the /admin/users/{user_id}/memberships/{membership_id} endpoint containing an additional membership[entity_id] parameter. This parameter is honored when the membership is updated, allowing an attacker to update the membership object associated with their own account (with manager role) to be associated with a different attacker-chosen account instead. Since account_ids are enumerable, an attacker can compromise all accounts present on the platform.
Mitigation
Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem.
For more information
If you have any questions or comments about this advisory email us at info(at)codevise.de
Credits
- Record
GHSA-qcqv-38jg-2r43- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 25 versions. The JSON record has them.