CyberRota Analysis
AI-GeneratedBloodHound versions up to 9.4.0 are vulnerable due to a missing authorization flaw in the custom-nodes API, allowing authenticated users to manipulate the global graph schema. This vulnerability enables attackers with valid session tokens to perform unauthorized operations, such as creating, updating, or deleting custom node types, which can impact all users and tenants. Organizations using BloodHound should prioritize patching to mitigate the risk of unauthorized modifications to their graph data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints.