Request to publish GHSA-24vc-w334-95wm in the GitHub Advisory Database

Esamina il contesto esistente di GHSA-24vc-w334-95wm insieme a Homer release 11.0.309 e pull request 920, quindi segui il workflow di curation di advisory-database per una vulnerabilità divulgata pubblicamente. Il lavoro è completato quando il problema confermato è stato esaminato e viene pubblicato un record pubblico di advisory appropriato con le versioni interessate e corrette, la gravità, l'impatto e la mitigazione.

Summary

Hello GitHub Security Advisory team,

I am the original reporter of GHSA-24vc-w334-95wm, an authenticated privilege-escalation vulnerability in sipcapture/homer.

I reported the issue through GitHub Private Vulnerability Reporting, provided a proof of concept, and verified the vulnerability. The maintainers confirmed the issue and released a fix in Homer 11.0.309.

The repository advisory was subsequently closed as resolved without public publication. Although the vulnerability and its fix are now mentioned publicly in the project release notes and pull request, there is no public advisory record describing the affected versions, severity, impact, and remediation.

I am therefore requesting that this vulnerability be reviewed for publication in the GitHub Advisory Database.

Vulnerability

An authenticated non-administrative user could update their own account through:

PATCH /api/v4/users/:id

The endpoint accepted privileged account fields, including user_group, allowing a low-privileged user to assign themselves the administrator role.

The issue resulted from a combination of incorrect authorization logic and improper modification of privileged object attributes.

The fix restricts modification of user_group and enabled to administrators while preserving ordinary self-service profile updates.

Version information

• Confirmed affected version: 11.0.307
• Fixed version: 11.0.309
• Exact introduced version: unknown

Classification

• CWE-863: Incorrect Authorization
• CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
• Severity: High

Suggested CVSS 4.0 vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Public references

• https://github.com/sipcapture/homer/releases/tag/11.0.309
• https://github.com/sipcapture/homer/pull/920

Request

Could the GitHub Security Advisory curation team review this confirmed, publicly disclosed, and fixed vulnerability and publish an appropriate global advisory record, using the existing GHSA-24vc-w334-95wm identifier if possible?

A public advisory would ensure that users of affected Homer versions are clearly informed about the privilege-escalation risk and the need to upgrade to version 11.0.309 or later.

It would also provide structured vulnerability information for security researchers, vulnerability-management platforms, and security scanners that consume GitHub Advisory Database data.

Reporter attribution or public credit is not required. My goal is to ensure that users of affected versions are appropriately informed.

I can provide additional information from the original private report through an appropriate non-public channel if required.