Request to publish GHSA-24vc-w334-95wm in the GitHub Advisory Database

Review the existing GHSA-24vc-w334-95wm context together with Homer release 11.0.309 and pull request 920, then follow the advisory-database curation workflow for a publicly disclosed vulnerability. Done means the confirmed issue is reviewed and an appropriate public advisory record is published with affected and fixed versions, severity, impact, and remediation.

Summary

Hello GitHub Security Advisory team,

I am the original reporter of GHSA-24vc-w334-95wm, an authenticated privilege-escalation vulnerability in sipcapture/homer.

I reported the issue through GitHub Private Vulnerability Reporting, provided a proof of concept, and verified the vulnerability. The maintainers confirmed the issue and released a fix in Homer 11.0.309.

The repository advisory was subsequently closed as resolved without public publication. Although the vulnerability and its fix are now mentioned publicly in the project release notes and pull request, there is no public advisory record describing the affected versions, severity, impact, and remediation.

I am therefore requesting that this vulnerability be reviewed for publication in the GitHub Advisory Database.

Vulnerability

An authenticated non-administrative user could update their own account through:

PATCH /api/v4/users/:id

The endpoint accepted privileged account fields, including user_group, allowing a low-privileged user to assign themselves the administrator role.

The issue resulted from a combination of incorrect authorization logic and improper modification of privileged object attributes.

The fix restricts modification of user_group and enabled to administrators while preserving ordinary self-service profile updates.

Version information

• Confirmed affected version: 11.0.307
• Fixed version: 11.0.309
• Exact introduced version: unknown

Classification

• CWE-863: Incorrect Authorization
• CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
• Severity: High

Suggested CVSS 4.0 vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Public references

• https://github.com/sipcapture/homer/releases/tag/11.0.309
• https://github.com/sipcapture/homer/pull/920

Request

Could the GitHub Security Advisory curation team review this confirmed, publicly disclosed, and fixed vulnerability and publish an appropriate global advisory record, using the existing GHSA-24vc-w334-95wm identifier if possible?

A public advisory would ensure that users of affected Homer versions are clearly informed about the privilege-escalation risk and the need to upgrade to version 11.0.309 or later.

It would also provide structured vulnerability information for security researchers, vulnerability-management platforms, and security scanners that consume GitHub Advisory Database data.

Reporter attribution or public credit is not required. My goal is to ensure that users of affected versions are appropriately informed.

I can provide additional information from the original private report through an appropriate non-public channel if required.