Loading story…
Researchers documented ORM Leak vulnerabilities in applications that pass user-controlled query parameters directly into ORM filtering APIs. Although ORMs can prevent traditional SQL injection, permissive filters, lookup operators, and relationship traversal can create boolean or error-based oracles that allow attackers to infer protected values character by character, including password hashes, password-reset tokens, API tokens, email addresses, and financial data. Affected patterns span Ruby on Rails Ransack, Django ORM, Beego-based Harbor, Prisma, Entity Framework, and ASP.NET OData; MySQL regular-expression timeouts and PostgreSQL filter behavior can also support error- or time-based inference attacks.
Real-world impact included compromise of a fablabs.io superadmin account after researchers extracted its password-reset token through Ransack queries. Harbor's related issue, tracked as CVE-2025-30086, required subsequent fixes after initial mitigations were bypassed through filter parsing and fuzzy-match behavior; Harbor v2.14.0 added complete-expression validation and approved-operator restrictions. Ransack 4.0.0 likewise changed its defaults to require explicit searchable-attribute and association allow lists. Organizations should never forward arbitrary request data into ORM filters, and should strictly allowlist fields, operators, traversals, and input types while testing relational queries for data inference and resource-exhaustion paths.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Researchers reported Beego's filter-expression parsing behavior to Beego contributors; the behavior could reinterpret a crafted expression such as email__password__startswith as password__startswith.
A warning was added to the Ransack documentation about processing unrestricted user-controlled query parameters.
Harbor v2.14.0 mitigated CVE-2025-30086 by validating the second filter-expression segment against an allow list of approved Beego operators.
Harbor v2.13.1-rc1 attempted to prevent the sensitive-field-filtering bypass by rejecting filter expressions containing more than one double-underscore separator. Its fuzzy-match operator mapping still enabled a bypass using an email__password field expression.
Harbor v2.13.0 introduced filterable metadata and marked User Password and Salt fields as non-filterable in response to CVE-2025-30086. The control validated only the first filter-expression segment and could be bypassed through Beego parsing behavior.
Ransack 4.0.0 changed the default behavior to require explicit allow lists for searchable attributes and associations, addressing unsafe unrestricted filtering patterns.
Researchers reported internet-exploitable critical and high-severity issues caused by unrestricted Ransack filtering in six applications, including CodeOcean, Pageflow, Active Admin, openSUSE Travel Support Program, fablabs.io, and PrepMod. They also identified several hundred additional potentially affected applications.
Researchers abused unrestricted Ransack association filtering to extract a reusable superadmin password-reset token, reset the account password, and promote their own account to superadmin. The compromise exposed phone numbers, email addresses, password hashes for about 60,000 users, and an API token for sensitive user data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
elttam.com
Open sourceelttam.com
Open sourceelttam.com
Open sourcepositive.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of recent technical write-ups and research articles highlight the ongoing risks posed by web application vulnerabilities, including source code disclosure, SQL injection, and insecure direct object references (IDOR). One case study demonstrates how a shopping website's backup files, accessible via a hidden directory, exposed sensitive source code and hard-coded database credentials due to improper directory listing and robots.txt configuration. Another firsthand account details a significant financial loss after a modern Spring Boot application suffered a SQL injection attack, bypassing ORM protections and security audits, which allowed an attacker to manipulate discount codes and process fraudulent transactions. These incidents underscore that even contemporary, well-maintained applications remain susceptible to classic vulnerabilities when security controls are inconsistently applied or overlooked. In addition to these real-world breaches, a technical explainer on IDOR vulnerabilities outlines why such flaws persist in modern API-driven environments, emphasizing the challenges of reliably enforcing object-level authorization. The article explains how IDORs often arise from overlooked workflow edges and inconsistent ownership validation, making them difficult to detect with standard security testing. Collectively, these reports serve as a reminder that legacy vulnerabilities like SQL injection and IDOR continue to threaten organizations, and that secure coding practices, comprehensive testing, and vigilant configuration management are essential to mitigating these risks.
Jun 29, 2026
OWASP's **API Security Top 10** identifies broken object-level and function-level authorization, excessive data exposure, security misconfiguration, and unsafe trust boundaries as leading API risks, warning that business logic abuse and operational gaps often turn ordinary endpoints into high-impact exposures. Those patterns were reflected in newly disclosed incidents involving both enterprise software and consumer-facing platforms, where low-privileged access was enough to reach data and functions intended for administrators or other users. In **CVE-2026-46515**, Frogman versions before `1.6.3` allowed users with only `PERM_READ` privileges to access administrative PBX data through MCP and HTTP APIs, including AMI manager secrets, outbound dial PINs, SIP secrets, backup paths, CDR history, and even root SSH connection commands; the flaw also enabled arbitrary execution of saved GraphQL queries and was rated **CVSS 9.3**. Separately, a bug bounty report on Target's Academy platform showed how two seemingly low-risk APIs could be chained to enumerate users and expose PII at scale, underscoring how weak authorization controls across interconnected endpoints can escalate routine API functionality into serious data disclosure.
Jul 19, 2026
A critical SQL injection vulnerability was discovered in the Orkes Conductor platform (version 5.2.4, platform v1.19.12), allowing authenticated attackers to exploit the `sort` parameter in the `/api/workflow/search` endpoint. By injecting crafted SQL expressions, attackers can perform time-based blind SQL injection attacks against the backend PostgreSQL database, bypassing basic input filtering. Proof-of-concept payloads demonstrated the ability to induce measurable delays in server response, confirming the vulnerability and enabling potential data exfiltration through timing-based inference. In addition to this real-world vulnerability, practical labs demonstrate exploitation techniques for blind SQL injection, including out-of-band data exfiltration and conditional error-based methods. These labs guide users through leveraging tracking cookies to inject payloads, using tools like Burp Suite and custom Python scripts to extract sensitive information such as administrator passwords from vulnerable databases. The combination of real-world disclosure and hands-on labs highlights the ongoing risk posed by blind SQL injection flaws and the importance of robust input validation and monitoring in web applications.
Jun 29, 2026