CVE-2026-28225

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28225", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.650Z", "datePublished": "2026-02-26T22:40:17.996Z", "dateUpdated": "2026-02-27T18:33:16.833Z"}, "containers": {"cna": {"title": "Manyfold has IDOR in ModelFilesController", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/manyfold3d/manyfold/security/advisories/GHSA-v8pw-3r2f-3fqm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/manyfold3d/manyfold/security/advisories/GHSA-v8pw-3r2f-3fqm"}, {"name": "https://github.com/manyfold3d/manyfold/releases/tag/v0.133.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/manyfold3d/manyfold/releases/tag/v0.133.1"}], "affected": [{"vendor": "manyfold3d", "product": "manyfold", "versions": [{"version": "< 0.133.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:40:17.996Z"}, "descriptions": [{"lang": "en", "value": "Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1, the `get_model` method in `ModelFilesController` (line 158-160) loads models using `Model.find_param(params[:model_id])` without `policy_scope()`, bypassing Pundit authorization. All other controllers correctly use `policy_scope(Model).find_param()` (e.g., `ModelsController` line 263). Version 0.133.1 fixes the issue."}], "source": {"advisory": "GHSA-v8pw-3r2f-3fqm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T18:18:53.353142Z", "id": "CVE-2026-28225", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:33:16.833Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28225", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T18:18:53.353142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:33:11.636Z"}}], "cna": {"title": "Manyfold has IDOR in ModelFilesController", "source": {"advisory": "GHSA-v8pw-3r2f-3fqm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "manyfold3d", "product": "manyfold", "versions": [{"status": "affected", "version": "< 0.133.1"}]}], "references": [{"url": "https://github.com/manyfold3d/manyfold/security/advisories/GHSA-v8pw-3r2f-3fqm", "name": "https://github.com/manyfold3d/manyfold/security/advisories/GHSA-v8pw-3r2f-3fqm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/manyfold3d/manyfold/releases/tag/v0.133.1", "name": "https://github.com/manyfold3d/manyfold/releases/tag/v0.133.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1, the `get_model` method in `ModelFilesController` (line 158-160) loads models using `Model.find_param(params[:model_id])` without `policy_scope()`, bypassing Pundit authorization. All other controllers correctly use `policy_scope(Model).find_param()` (e.g., `ModelsController` line 263). Version 0.133.1 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:40:17.996Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28225", "state": "PUBLISHED", "dateUpdated": "2026-02-27T18:33:16.833Z", "dateReserved": "2026-02-25T15:28:40.650Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:40:17.996Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "manyfold", "vendor": "manyfold3d", "versions": [{"status": "affected", "version": "< 0.133.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:manyfold:manyfold:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2BF73EA-32B4-4B68-92BC-BC17A045C023", "versionEndExcluding": "0.133.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1, the `get_model` method in `ModelFilesController` (line 158-160) loads models using `Model.find_param(params[:model_id])` without `policy_scope()`, bypassing Pundit authorization. All other controllers correctly use `policy_scope(Model).find_param()` (e.g., `ModelsController` line 263). Version 0.133.1 fixes the issue."}, {"lang": "es", "value": "Manyfold es una aplicaci\u00f3n web de c\u00f3digo abierto y autoalojada para gestionar una colecci\u00f3n de modelos 3D, particularmente enfocada en la impresi\u00f3n 3D. Antes de la versi\u00f3n 0.133.1, el m\u00e9todo `get_model` en `ModelFilesController` (l\u00ednea 158-160) carga modelos usando `Model.find_param(params[:model_id])` sin `policy_scope()`, eludiendo la autorizaci\u00f3n de Pundit. Todos los dem\u00e1s controladores usan correctamente `policy_scope(Model).find_param()` (por ejemplo, `ModelsController` l\u00ednea 263). La versi\u00f3n 0.133.1 corrige el problema."}], "id": "CVE-2026-28225", "lastModified": "2026-06-17T10:28:21.923", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28225", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T18:18:53.353142Z", "version": "2.0.3"}}]}, "published": "2026-02-26T23:16:36.413", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/manyfold3d/manyfold/releases/tag/v0.133.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/manyfold3d/manyfold/security/advisories/GHSA-v8pw-3r2f-3fqm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.133.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "manyfold", "source": "cna", "vendor": "manyfold3d"}, "product": "manyfold", "vendor": "manyfold3d"}], "analysis": {"en": {"generated_at": "2026-04-16T15:55:40.780736+00:00", "value": {"mitigation_remediation": ["Update Manyfold to version 0.133.1 or later, which restores policy_scope protection in the get_model method.", "If an upgrade is delayed, restrict access to the /models/* URLs using network firewall rules or HTTP authentication so that only privileged users can reach them.", "Verify that Pundit policy scopes are applied correctly in all controllers; if custom policies exist, run tests to ensure they enforce ownership checks on model retrieval."], "summary": {"action": "Patch", "impact": "Unauthorized access to private model files"}, "threat_synthesis": {"affected_systems": "Any installation of Manyfold 0.133.0 or earlier that has not applied the 0.133.1 release. The affected component is the ModelFilesController in the open\u2011source Manyfold web application, which is typically deployed as a self\u2011hosted Ruby on Rails service. Users who have access to the web interface and an authenticated session are able to trigger the vulnerability.", "description_and_impact": "The vulnerability is an insecure direct object reference in the get_model method of the ModelFilesController. Because the code uses Model.find_param(params[:model_id]) without wrapping the call in a policy scope, the authorization layer is bypassed. An attacker who has legitimate credentials with read permissions can request the URL that loads a model by ID and retrieve the contents of any model in the system, regardless of ownership. This leak of proprietary or sensitive 3D designs could lead to data confidentiality loss and potential intellectual property theft.", "risk_and_exploitability": "The CVSS score of 5.3 categorizes this as a moderate severity flaw. The EPSS score of less than 1% suggests that, while exploitation is unlikely at large scale, the presence of an authenticated user that can supply arbitrary IDs makes the attack feasible without additional reconnaissance. The vulnerability is not yet listed in the CISA KEV catalog, so no known active exploits are reported, but the lack of a policy scope is a direct authorization bypass. The likely attack vector is a remote attacker with valid credentials who submits a crafted request to the get_model endpoint, forcing retrieval of unauthorized models."}}}}, "created": "2026-02-27T09:03:49.519072+00:00", "updated": "2026-04-16T16:00:13.883552+00:00", "vendors": ["manyfold3d", "manyfold3d$PRODUCT$manyfold"]}