Missing Authorization with Default Settings in Dashboard UI

Vulnerability

In Hangfire.Core version 1.7.25, the default authorization filter LocalRequestsOnlyAuthorizationFilter was inadvertently omitted from the DashboardOptions.Authorization property when using the UseHangfireDashboard method without specifying custom filters [1][2][4]. This regression allowed remote HTTP requests to access the Dashboard UI, which previously required local requests only. Versions prior to 1.7.25 and patched versions 1.7.26+ are not affected.

Exploitation

An attacker with network access to the Hangfire Dashboard endpoint can exploit this vulnerability by sending a simple HTTP request to the Dashboard URL (e.g., /hangfire) without any authentication or authorization [4]. No user interaction or special privileges are required; the default configuration is sufficient for exploitation.

Impact

Successful exploitation grants the attacker read access to the Hangfire Dashboard, exposing sensitive background job data such as job parameters, method names, arguments, and execution history [2][4]. This constitutes an information disclosure vulnerability, potentially revealing application internals or sensitive data processed by background jobs. No remote code execution or privilege escalation is reported.

Mitigation

The issue is fixed in Hangfire.Core version 1.7.26, available on NuGet.org and GitHub [1][4]. Users should upgrade to this version or later. For those unable to upgrade, a workaround is to explicitly configure the LocalRequestsOnlyAuthorizationFilter in the DashboardOptions.Authorization property when calling UseHangfireDashboard [4].