Hay-Kot Mealie Broken Object Level Authorization Vulnerability Allowing Permission Edits by Group Managers

A Broken Object Level Authorization vulnerability has been identified in Hay-Kot Mealie version 2.2.0. This vulnerability allows group managers to edit their own permissions. The issue arises in the '/households/permissions' component, where group managers can manipulate API calls to change their permission levels or household affiliations, actions typically reserved for administrators.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing group managers to gain additional permissions or access rights within the application.

Reproduction

To reproduce this vulnerability, a group manager can send a request to the '/api/households/permissions' endpoint. By including their own user ID in the request, they can change permissions for themselves, such as gaining the ability to manage household members or access recipes and shopping lists from other households.

Remediation

This vulnerability has been fixed in Hay-Kot Mealie version 2.5.0.