Summary
Hello GitHub Security Advisory team,
I am the original reporter of GHSA-24vc-w334-95wm, an authenticated privilege-escalation vulnerability in sipcapture/homer.
I reported the issue through GitHub Private Vulnerability Reporting, provided a proof of concept, and verified the vulnerability. The maintainers confirmed the issue and released a fix in Homer 11.0.309.
The repository advisory was subsequently closed as resolved without public publication. Although the vulnerability and its fix are now mentioned publicly in the project release notes and pull request, there is no public advisory record describing the affected versions, severity, impact, and remediation.
I am therefore requesting that this vulnerability be reviewed for publication in the GitHub Advisory Database.
Vulnerability
An authenticated non-administrative user could update their own account through:
The endpoint accepted privileged account fields, including user_group, allowing a low-privileged user to assign themselves the administrator role.
The issue resulted from a combination of incorrect authorization logic and improper modification of privileged object attributes.
The fix restricts modification of user_group and enabled to administrators while preserving ordinary self-service profile updates.
Version information
- Confirmed affected version:
11.0.307
- Fixed version:
11.0.309
- Exact introduced version: unknown
Classification
- CWE-863: Incorrect Authorization
- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
- Severity: High
Suggested CVSS 4.0 vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Public references
Request
Could the GitHub Security Advisory curation team review this confirmed, publicly disclosed, and fixed vulnerability and publish an appropriate global advisory record, using the existing GHSA-24vc-w334-95wm identifier if possible?
A public advisory would ensure that users of affected Homer versions are clearly informed about the privilege-escalation risk and the need to upgrade to version 11.0.309 or later.
It would also provide structured vulnerability information for security researchers, vulnerability-management platforms, and security scanners that consume GitHub Advisory Database data.
If the vulnerability is eligible for CVE assignment and falls within GitHub’s CNA scope, please also consider assigning a CVE identifier for broader coverage across vulnerability databases and security products.
If CVE assignment cannot be initiated through this request, publication in the GitHub Advisory Database remains the primary request.
Reporter attribution or public credit is not required. My goal is to ensure that users of affected versions are appropriately informed.
I can provide additional information from the original private report through an appropriate non-public channel if required.
Summary
Hello GitHub Security Advisory team,
I am the original reporter of
GHSA-24vc-w334-95wm, an authenticated privilege-escalation vulnerability insipcapture/homer.I reported the issue through GitHub Private Vulnerability Reporting, provided a proof of concept, and verified the vulnerability. The maintainers confirmed the issue and released a fix in Homer
11.0.309.The repository advisory was subsequently closed as resolved without public publication. Although the vulnerability and its fix are now mentioned publicly in the project release notes and pull request, there is no public advisory record describing the affected versions, severity, impact, and remediation.
I am therefore requesting that this vulnerability be reviewed for publication in the GitHub Advisory Database.
Vulnerability
An authenticated non-administrative user could update their own account through:
The endpoint accepted privileged account fields, including
user_group, allowing a low-privileged user to assign themselves the administrator role.The issue resulted from a combination of incorrect authorization logic and improper modification of privileged object attributes.
The fix restricts modification of
user_groupandenabledto administrators while preserving ordinary self-service profile updates.Version information
11.0.30711.0.309Classification
Suggested CVSS 4.0 vector:
Public references
Request
Could the GitHub Security Advisory curation team review this confirmed, publicly disclosed, and fixed vulnerability and publish an appropriate global advisory record, using the existing
GHSA-24vc-w334-95wmidentifier if possible?A public advisory would ensure that users of affected Homer versions are clearly informed about the privilege-escalation risk and the need to upgrade to version
11.0.309or later.It would also provide structured vulnerability information for security researchers, vulnerability-management platforms, and security scanners that consume GitHub Advisory Database data.
If the vulnerability is eligible for CVE assignment and falls within GitHub’s CNA scope, please also consider assigning a CVE identifier for broader coverage across vulnerability databases and security products.
If CVE assignment cannot be initiated through this request, publication in the GitHub Advisory Database remains the primary request.
Reporter attribution or public credit is not required. My goal is to ensure that users of affected versions are appropriately informed.
I can provide additional information from the original private report through an appropriate non-public channel if required.