Unblu Spark Authorization Bypass Vulnerability Allowing File Replacement via UUID

A vulnerability in Unblu Spark versions through 8.12.1 allows participants in a conversation to replace an existing uploaded file, provided they have access to the file's UUID. The replacement can be made without altering the file name, details, or the identity of the original uploader. This issue arises from an authorization bypass, as the file upload functionality can be disabled for specific use cases, yet Unblu still processes file uploads through the API. During the upload, the application correctly applies file type restrictions and interception rules.

Impact

Exploitation of this vulnerability allows for unauthorized replacement of files in a conversation, potentially leading to misinformation or misuse of shared documents.

Remediation

Users can upgrade to Unblu Spark version 8.13.1 to address this vulnerability.