Missing Authorization check allows certain operations on CLA Assistant data

CVE-2023-39438

Summary

A missing authorization check in the CLA-assistant API permits any authenticated user to conduct unauthorized operations. This includes the ability to read sensitive CLA information and configurations tied to repositories or organizations. Specifically, users can access details about CLA signers and custom fields configured by CLA requesters. Furthermore, they can update or even delete existing CLA configurations. Fortunately, stored access tokens for GitHub remain secure as they are redacted in the API responses.

References