High · published November 26, 2025
⚠️ Oops! The groov View API's users endpoint spills the beans on all users and their API keys, even for Administrators! 🔑 Think of it as a restaurant's kitchen where every chef can peek behind the curtain to see each other's special recipes — some of those recipes are secret sauces that should stay under wraps! 🍽️ If someone with an Editor role accesses this endpoint, they could expose sensitive API keys for every user in the system. This could lead to unauthorized access and actions taken by malicious actors, potentially causing chaos in your application. That's a recipe for disaster! 😱
Think of it as a restaurant's kitchen where every chef can peek behind the curtain to see each other's special recipes — some of those recipes are secret sauces that should stay under wraps! 🍽️ This vulnerability allows users with the Editor role to list all users and their associated API keys through the groov View API, compromising the security of the entire user base by exposing sensitive credentials.
If someone with an Editor role accesses this endpoint, they could expose sensitive API keys for every user in the system. This could lead to unauthorized access and actions taken by malicious actors, potentially causing chaos in your application. That's a recipe for disaster! 😱 To remediate this, ensure that access to the users endpoint is restricted only to users with appropriate privileges, such as Administrators. Review your role definitions and consider implementing stricter access controls. 🛡️ You've got this! Follow these steps to lock it down and secure your application! 🚀