Advisories for Golang/Github.com/Perses/Perses package

When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters (validation/Flatten only runs for Create/Update bodies, not list queries). The path is then used to retrieve files in the database directly. Attacker can read arbitrary YAML/JSON files from the server host and can bypass the security constraints to …

What kind of vulnerability is it? An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources. Who is impacted? Any authenticated user reads every project's dashboards, datasources, variables across tenants.

The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check. Datasource and Secret are distinct, independently grantable role scopes, so an operator can grant datasource access without secret access. The proxy and the service to create a datasource does not verify that the operator has the correct right. A user holding only GlobalDatasource:create can create …