2024-01-06.md

Jan-06-2024 - Adding Items to any User's Collections

Reported on Immunefi	Jan-06-2024
Mitigation	Jan-06-2024
Solution Completed	Jan-06-2024

Description

Due to missing access controls on the endpoint to create new items, it was possible to add any item to any user's collection by using their collection UUID.

Severity

Websites & Applications - High.

Solution

Add missing validation to the endpoint.