AIKIDO-2026-77784

dash is vulnerable to Insecure Direct Object Reference (IDOR)

Insecure Direct Object Reference (IDOR) Pre-CVE Published Jul 28, 2026

Medium Risk

This Affects:

dash

2.0.0 - 4.4.0

Fixed in 4.4.1

Are you affected? Scan for Free

TL;DR

Dash background callbacks read the job, oldJob, cancelJob, and cacheKey handles directly from client-supplied query parameters and act on them without verifying that the server issued them. An unauthenticated client can send a chosen job value so that a DiskcacheManager-backed app terminates an arbitrary process by its PID, or send an arbitrary cacheKey to read and delete result-cache entries belonging to other sessions. Because the handles are not signed or bound to a page load, forged or replayed values are accepted. The fix HMAC-signs the cacheKey and job handles, binds them to a per-page-load token, and verifies them server-side before terminating jobs or returning cached results.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application runs background callbacks configured with a background callback manager such as DiskcacheManager or CeleryManager.