SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Open Food Network patches high-severity bug letting shops alter rival stores' customer balances

0
·1 views

A high-severity broken object-level authorization vulnerability was discovered in Open Food Network (OFN), the platform used by food hubs and farmer co-ops worldwide. The flaw in the POST /api/v1/customer_account_transaction endpoint allowed any enterprise manager to create, modify, or read financial ledger entries belonging to customers of other enterprises by supplying an arbitrary customer ID in the request body. The bug, classified as CWE-639 and CWE-862 with a CVSS score of 7.1, became exploitable across all instances after version 5.7.1 removed a feature flag that had previously restricted access to the vulnerable API. OFN's authorization framework correctly scoped the parent Customer model per enterprise but failed to apply the same record-level restriction to child transaction records. The vulnerability was fixed in OFN version 5.7.4, with an advisory published on 28 July 2026 under GHSA-7cqp-qvh5-7x85; a CVE assignment is still pending.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

JooqTemplate Library Simplifies Java Database Operations Without Annotations or Null Checks

A developer has published a demonstration of JooqTemplate, a utility layer built on top of the JOOQ library for Java database interactions. The library allows developers to perform standard CRUD operations — insert, update, delete, and select — using concise variable-parameter methods without requiring annotations or null checks. Key features include automatic ignoring of null query parameters, camelCase-to-snake_case field mapping, and support for complex queries such as pagination, OR conditions, and LEFT JOIN operations. The demo showcases a UserService class that handles user data management with significantly reduced boilerplate code compared to traditional approaches. JooqTemplate appears aimed at developers seeking a lightweight, configuration-free alternative to ORM frameworks like Hibernate or MyBatis.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Plumeria CSS Library Promises Zero Runtime Overhead With Full Type Safety

Plumeria is a new CSS-in-JS library designed to combine the predictability of CSS Modules with the type-safe developer experience of modern styling solutions. Its compiler statically resolves class names and rewrites call sites at build time, meaning no styling library code, imports, or class-mapping objects remain in the production JavaScript bundle. Every CSS property-value pair compiles into a shared atomic class, preventing stylesheet growth from scaling with component count. The library claims to ship 1.83KB less client JavaScript than StyleX on comparable Next.js applications, based on published benchmarks. Plumeria relies on static analysis and direct AST rewrites rather than executing application code, keeping build pipelines fast and output deterministic regardless of file structure or bundling order.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

TypeScript Enums vs Const Objects: Key Tradeoffs Developers Should Know in 2026

TypeScript enums remain a debated topic because, unlike interfaces or type aliases, they generate real JavaScript objects at runtime rather than disappearing at compile time. This runtime footprint can increase bundle size, break tree-shaking, and cause unexpected serialization behavior — costs that accumulate silently in production builds. Numeric enums offer useful features like reverse mapping and bitwise flags, making them suitable for low-level or performance-critical APIs, but they double object size and complicate JSON output. Const objects paired with 'as const' assertions deliver equivalent type safety with zero runtime overhead and integrate cleanly with modern module systems and tree-shaking tools. Developers are advised to default to const objects for most use cases and reserve enums only for scenarios where their runtime behavior provides a clear, specific advantage.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

TP-Link Tapo H100 and Sub-GHz Sensors Bring Smart Cellar Humidity Monitoring to Home Assistant

A homeowner set up a TP-Link Tapo H100 smart hub with a T310 temperature and humidity sensor to monitor cellar conditions and prevent mould caused by condensation. The H100 communicates with its battery-powered sensors over 868 MHz sub-GHz radio, which penetrates concrete far more reliably than standard 2.4 GHz Wi-Fi, making it well suited for basement environments. Because TP-Link's native Home Assistant integration does not expose the H100's child sensors, the community-built Tapo Controller integration via HACS is required to bring the readings into the platform. Rather than relying on raw relative humidity figures, which can be misleading without temperature context, the author converts the two sensor readings into a dew-point value using the Magnus formula. This dew-point spread against the cellar's coldest surface temperature is used as the true trigger for condensation risk alerts, avoiding false alarms on ordinary humid days.

0 comments Read more at DEV Community
Open Food Network patches high-severity bug letting shops alter rival stores' customer balances · ShortSingh