Security

• Fixed insecure multi-tenancy boundary in location REST API

  Fixed a security issue that allowed organization managers to link locations and floorplans belonging to other organizations to their devices by submitting known object IDs.

  The API now resolves related objects only from organizations managed by the requesting user and validates the organization of all device-location relationships. Device lists for a location are scoped to managed organizations and no longer expose device keys.

  Nested location and floorplan writes are validated before being saved and run in a database transaction, preventing rejected requests from leaving related database objects or files behind.

  Advisory: GHSA-39c4-xj33-j8j3.

• Fixed XSS vulnerabilities in device and command admin UI

  Fixed cross-site scripting (XSS) vulnerabilities caused by improper escaping of user-controlled data in the following admin pages:

  • Device and device group forms (template names).
  • Device pages (command inputs, outputs, and management IP).
  • Subnet administration (device names and links).

  These vulnerabilities could allow attackers to execute malicious JavaScript in an administrator's browser.

  Advisory: GHSA-4f2x-pxjx-h8m3.

Bugfixes

• Fixed loss of data in PATCH requests to device location endpoint #1510

  Sending PATCH requests to the device location endpoint (/api/v1/controller/device/{id}/location/) now doesn't set location and floorplan to NULL when they are not included in the request body.

Changes

• Added IP address search to DeviceAdmin

  Enabled searches by last and management IP addresses.