Unrated severityNVD Advisory· Published Feb 19, 2025· Updated Feb 19, 2025
Improper Authorization in /user/namespace/{namespace}/details
CVE-2025-1007
Description
In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.
Affected products
2- Range: >=0.9.0 <=0.20.0
- Eclipse Foundation/OpenVSXv5Range: 0.9.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.