code-gen Incorrect Access Control Vulnerability

An incorrect access control vulnerability has been identified in code-gen versions through 2.0.6. The issue arises because the project lacks proper permission controls, allowing anyone to access projects hosted publicly. This vulnerability could lead to unauthorized access to sensitive information, such as database credentials.

Impact

Exploitation of this vulnerability could result in unauthorized access to publicly available projects, potentially exposing sensitive information like database usernames and passwords.

Reproduction

The vulnerability can be reproduced by accessing a public project created with the code-gen tool, which is a code generation utility that supports MySQL, Oracle, SQL Server, and PostgreSQL. The absence of access controls allows any user to view the project, including sensitive data such as database connection details.