Manyfold Missing Authorization Vulnerability in ModelFilesController Allows Unauthorized File Access and Conversion

A vulnerability in Manyfold versions prior to 0.133.1 allows authenticated contributors to bypass authorization checks in the ModelFilesController. The 'get_model' method fails to use 'policy_scope()', enabling unauthorized access to models and their associated files. This oversight affects all model_files endpoints and allows contributors to modify, delete, and unlawfully convert files from models they do not own.

Impact

Exploitation of this vulnerability enables authenticated contributors to access, edit, and delete files from any model, including those in libraries outside their permission scope. Additionally, the vulnerability allows unauthorized conversion of files by any contributor, regardless of model ownership.

Remediation

Users can update to Manyfold version 0.133.1 to address this vulnerability.