API Misconfiguration in OpenVSX Affects Namespace Security

CVE-2025-1007

Summary

In OpenVSX versions ranging from v0.9.0 to v0.20.0, a vulnerability exists in the /user/namespace/{namespace}/details API endpoint that permits unauthorized users to modify namespace details, including the name, description, website, support link, and social media links. Additionally, the /user/namespace/{namespace}/details/logo endpoint is affected, allowing users to change the logo without proper authorization. This security flaw raises serious concerns over the integrity and control of namespace data.

References