meilisearch

Meilisearch v1.48.2 and Meilisearch v1.47.1 address CVEs with request ID 2062078.
We recommend updating if you are in one of the following situations:

1. You have API keys where indexes is not ["*"] and where actions contains more permissions than: ["search", "documents.*", "indexes.*", "tasks.cancel", "tasks.delete", "tasks.get", "settings.*", "stats.*", "fields.post"]
2. You have search tenant tokens and either an embedder or a chat workspace

• We recommend that users of Meilisearch v1.48 update to Meilisearch v1.48.2
• We recommend that users of Meilisearch v1.47 or lower update to Meilisearch v1.47.1

These versions both fix the following:

1. Improper authentication leads to privilege escalation: an authenticated user with an index-scoped API and the appropriate set of actions could use global actions to read and write the global state of the Meilisearch instance. Possibly impacted users of Meilisearch Cloud were contacted ahead-of-time.
2. Improper authentication leads to information disclosure: a user with a search tenant token could get some limited information about the existence of a document outside of the scope of the search rules attached to the tenant token, an indirect information about the content of the document.

We detected no trace of exploitation of these vulnerabilities.

We thank PuH4ck3rX for reporting these vulnerabilities :heart: