Read the researcher's report on HackerOne
A project tag could be set to a null value, which caused the project interface to fail and blocked access to project resources. The report describes impact through both an editor changing a shared project and an attacker inviting a target to a project containing the malformed tag.
How it was found
- The researcher examined project tags and sharing behavior.
- They observed that tag names were not type-validated and tested a null value.
- They confirmed the malformed tag prevented project listing and management.
- They tested propagation through shared-project editing and inviting a target to the affected project.
- Access needed
- A user account · an account
- User interaction
- None
- Whose object
- Another tenant's
- Boundary crossed
- A project invitation exposed a malformed project to another user's project list, disrupting access to project resources.
- Root cause
- The application accepted a null tag name and the front end could not handle it, causing project access workflows to fail.
- Impact
- An affected user could lose access to viewing and managing projects associated with the malformed tag.
- Fix
- Validate tag-name types and reject null values.
- Payload class
- null-valued tag name
- Components
- project tags, project management interface, project sharing
- Confidence
- high
Denial of serviceBusiness logic flaw
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-15. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Posts sent via websockets aren't sanitized properly | A user account | The attacker's own | A post author supplied unvalidated nested embed data that was broadcast to other users' clients. |
| Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick` | No account | Another tenant's | A public caller created a fabricated auction that crossed into trusted liquidation accounting and redemption of system collateral. |
| Bypass of GitLab CI runner slash fix in YAML validation | A user account | The attacker's own | A project CI variable bypassed cache-key validation and affected cache handling in a pipeline. |
| Bypass of Restricted Keyword "Mozilla" in Display Name Field via Unicode Homoglyphs on addons.allizom.org | A user account | The attacker's own | The display-name restriction was bypassed using a Unicode homoglyph. |
| Deadlock in x86 HVM standard VGA handling | A user account | No object involved | Guest kernel execution triggered a deadlock in the host hypervisor. |
| Improper UUID validation results in bypass of #419896 | No account | No object involved | No security boundary crossing was demonstrated; the server accepted malformed input. |
| ImageId Format Injection in Image Upload Endpoint | A user account | The attacker's own | An authenticated user created an image identifier outside the expected format. |
| jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing | A user account | No object involved | A caller-controlled header crossed from call setup into trusted outbound SIP signaling. |
| Incorrect Deep-link validation leading to unresponsive application and device | No account | No object involved | A crafted deep link caused the app to become unresponsive. |
| CVE-2020-8177: curl overwrite local file with -J | A user account | The attacker's own | A server-controlled response filename replaced an existing file on the local filesystem. |
| Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick` | No account | The attacker's own | An attacker used fabricated auction records to withdraw MKR held by the auction contract. |
| CSS Injection to disable app & potential message exfil | A user account | No object involved | A custom theme value crossed from a color preference into app-wide styling. |