Taeyoung Jeong.

Improper symlink handling in qbee-agent's createFile helper lets an unprivileged user escalate to root — e.g. replacing their .ssh directory with a symlink to /root/.ssh for root SSH access, corrupting system files during RAUC staging, or redirecting file-distribution writes to seize ownership. (CWE-59 / CWE-22 / CWE-367)

n8n's Enterprise SSO fails to block assignment of the global:owner role through instance-role provisioning. With N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE enabled, an SSO user whose IdP-supplied instance-role claim maps to global:owner gains full instance-owner access — a capability explicitly blocked on the token-exchange path.

On the ICE-mobility session-resume path, credential adoption is skipped when the attacker's session is already authenticated, so ownership of the victim's allocation is never re-validated — enabling cross-user takeover of an active TURN allocation. Found via an auth-layer ↔ handler asymmetry in the STUN attribute view, then confirmed dynamically.

An authenticated TURN user can inject printf-style format specifiers (%s, %x, %n) through the STUN USERNAME or REALM attributes: is_secure_string() blocks shell and SQL metacharacters but never filters %. The tainted key is passed as a format string to redisAsyncCommand() with too few variadic arguments across nine call sites in ns_ioalib_engine_impl.c, reading past the va_list — crashing the process (dropping all TURN sessions) or disclosing stack memory into Redis. (CWE-134)