AIKIDO-2026-590122

TL;DR

The bulk notification endpoints open_all and destroy_all in NotificationsController forward unfiltered request parameters to the model layer, where a custom_filter value is passed directly to ActiveRecord where as a raw SQL string. An attacker can supply a crafted custom_filter to inject arbitrary SQL conditions, and two of the affected API endpoints are reachable without authentication. This allows mass modification or deletion of notification records and boolean-based blind data exfiltration. The fix restricts the controllers to a permitted set of filter keys and rejects a raw SQL string custom_filter by raising an error before it reaches the query.