UnoPim has Broken Access Control
Summary
In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.
Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption
Affected Behavior
Single delete (enforced):
DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.
Mass delete (not enforced):
POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.
PoC
A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.
Impact
Unauthorized product deletion -> data loss, possible business disruption
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | unopim/unopim | < 0.3.1 | 0.3.1 |
References
- https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx
- https://nvd.nist.gov/vuln/detail/CVE-2025-55741
- https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989
- https://github.com/unopim/unopim/commit/f49fa630afd36ff61c146b3e5bc7a0808667ca19
- https://github.com/unopim/unopim
- https://www.youtube.com/watch?v=J_WV8fCXlJM
- https://youtu.be/J_WV8fCXlJM
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H- Weakness (CWE)
CWE-284, CWE-862- Platform
- Composer
- Package
unopim/unopim- Disclosed
- 22.08.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8p2f-fx4q-75cx - CC BY 4.0
Vulnerability history: unopim/unopim
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 11.2024 08.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 4
- Low 1
Disclosures per year
- 2024: 2
- 2025: 5
- 2026: 0
-
UnoPim has Broken Access Control this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.