Request to publish GHSA-24vc-w334-95wm in the GitHub Advisory Database

既存の GHSA-24vc-w334-95wm のコンテキストを Homer release 11.0.309 および pull request 920 と併せて確認し、その後、公開された脆弱性に対する advisory-database のキュレーションワークフローに従ってください。確認済みの問題がレビューされ、影響を受けるバージョンと修正済みバージョン、深刻度、影響、修正方法を含む適切な公開 advisory レコードが公開されれば完了です。

Summary

Hello GitHub Security Advisory team,

I am the original reporter of GHSA-24vc-w334-95wm, an authenticated privilege-escalation vulnerability in sipcapture/homer.

I reported the issue through GitHub Private Vulnerability Reporting, provided a proof of concept, and verified the vulnerability. The maintainers confirmed the issue and released a fix in Homer 11.0.309.

The repository advisory was subsequently closed as resolved without public publication. Although the vulnerability and its fix are now mentioned publicly in the project release notes and pull request, there is no public advisory record describing the affected versions, severity, impact, and remediation.

I am therefore requesting that this vulnerability be reviewed for publication in the GitHub Advisory Database.

Vulnerability

An authenticated non-administrative user could update their own account through:

PATCH /api/v4/users/:id

The endpoint accepted privileged account fields, including user_group, allowing a low-privileged user to assign themselves the administrator role.

The issue resulted from a combination of incorrect authorization logic and improper modification of privileged object attributes.

The fix restricts modification of user_group and enabled to administrators while preserving ordinary self-service profile updates.

Version information

• Confirmed affected version: 11.0.307
• Fixed version: 11.0.309
• Exact introduced version: unknown

Classification

• CWE-863: Incorrect Authorization
• CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
• Severity: High

Suggested CVSS 4.0 vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Public references

• https://github.com/sipcapture/homer/releases/tag/11.0.309
• https://github.com/sipcapture/homer/pull/920

Request

Could the GitHub Security Advisory curation team review this confirmed, publicly disclosed, and fixed vulnerability and publish an appropriate global advisory record, using the existing GHSA-24vc-w334-95wm identifier if possible?

A public advisory would ensure that users of affected Homer versions are clearly informed about the privilege-escalation risk and the need to upgrade to version 11.0.309 or later.

It would also provide structured vulnerability information for security researchers, vulnerability-management platforms, and security scanners that consume GitHub Advisory Database data.

Reporter attribution or public credit is not required. My goal is to ensure that users of affected versions are appropriately informed.

I can provide additional information from the original private report through an appropriate non-public channel if required.