Description
TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.6.2
References
Could your website be exposed too?
SmartScanner can check your website for TaffyDB can allow access to any data items in the DB - taffy and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TaffyDB can allow access to any data items in the DB - CVE-2019-10790
- Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - CVE-2026-44374
- Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common - CVE-2026-44374
- Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023