A public prototype pollution CVE in @orpc/client reached the Veraxis pre-production API and turned an unauthenticated request into a superadmin escalation across warm serverless containers. Full attack chain, CVE cross-reference, remediation.
Umbrella page for the five individual finding writeups below. Executive summary, findings table, root cause and recommendation across all five, plus the timeline.
One unauthenticated POST to /api/segment/evaluate returns records for any organisation named in the request body. No session, no cookie, no rate limit. F-04 turns this into a full read of every tenant.
An authenticated user in tenant A creates arbitrary segments inside tenant B by supplying the target organisation identifier on the create body. Data integrity and downstream campaign risk across the tenant boundary.
A low-privilege user reads analytics for any tenant on the platform, including SMS message content, replies, and campaign metadata. The same pattern as F-01 with a much broader exposed data set.
The analytics UI leaks every tenant's organisation identifier to any logged-in user. Low severity on its own; the primitive that turns F-01 and F-03 from theoretically exploitable into universally exploitable.
The /api/shift/adminGetAll endpoint returns cross-tenant administrative shift data to any non-admin session, including isAdmin flags on assignees. A targeting primitive as much as an information disclosure.