GHSA-frwq-4xqx-frmc: 
Python vulnerability analysis and mitigation

Impact

In Atlaso 0.9.18 through 0.9.488, a holder of a valid restricted API token with read:dashboard could issue another token through POST /api/v1/api-tokens. The endpoint checked the requested scopes against the account owner's roles. A restricted token owned by an administrator could therefore issue a new admin:all token. The new token had its own expiration and remained valid after revocation of the issuing token.

Fix

Atlaso 0.9.489 requires admin:all for bearer-token issuance through this endpoint. Password-authenticated API login and the signed-in management UI can still issue tokens within the account's current permissions. The update prevents new issuance through this path. If a restricted token may have been exposed, review API token creation audit events and revoke unauthorized tokens as well as the exposed credential. Fix commit Download Atlaso 0.9.489