The Scratch Channel Forking Vulnerability Allows Unauthorized Article Publication

A vulnerability exists in The Scratch Channel's web client, specifically in versions 1.0 and 1.1, that allows users to publish articles without proper authorization. This issue arises when a user forks a project, as they can manipulate admin settings to facilitate article creation. The vulnerability is exploited through the API's POST request functionality, enabling the unauthorized publication of content.

Impact

Exploitation of this vulnerability could lead to unauthorized article publication, potentially allowing for the spread of misinformation or harmful content.

Remediation

Users can update to version 1.2 to address this vulnerability.