Authorization Bypass Vulnerability in Router Inbox (DOPPLER-SA-0002)

Summary

A critical vulnerability was found in the Inbox feature, when an authenticated user with router.inbox access could intercept and take control of devices outside their access group before they were allowed.

Remediation

Customers should update to v22.12 or later.

Affected Versions

• v22.09.13 and earlier versions of Doppler