Missing Authorization Vulnerability in Swetrix Cloud

Swetrix Cloud versions prior to 5.1.0 are affected by a missing authorization vulnerability within the ProjectController.addProject endpoint. This flaw allows any authenticated user to hijack arbitrary projects by moving them into their own organization. By leveraging the project's public tracking ID, an attacker can manipulate project ownership, granting them unauthorized access to sensitive analytics, modification of project configuration settings, or the ability to perform a permanent deletion of the victim project. This vulnerability represents a significant risk to data integrity and availability for users of the Swetrix platform, as it permits unauthorized cross-tenant resource manipulation.

Impact

Successful exploitation of this vulnerability allows unauthorized users to gain full administrative or read-only control over projects belonging to other organizations. This results in the potential exposure of private analytics data and enables destructive actions such as the deletion of victim projects, directly impacting the confidentiality and availability of customer data stored within the Swetrix Cloud environment.

Recommendation

• Upgrade Swetrix Cloud to version 5.1.0 or later immediately to address the missing authorization vulnerability in ProjectController.
• Audit project ownership logs within the Swetrix platform to identify any unauthorized transfers or unexpected changes in project association that may have occurred prior to patching.