TI-2021-18030 Aliases CVE-2021-41191

API giving out files without key

LOW 36CWE-116Published 2021-10-27 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`.

Why it matters now

EPSS 0.01371 72nd percentileScored 2026-11-07

Fix Fixed Roblox-Purchasing-Hub (Redon-Tech): 1.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Redon-Tech	Roblox-Purchasing-Hub	before 1.0.2	1.0.2	Patch available	CNA

Roblox-Purchasing-Hub VendorRedon-Tech Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:redon:roblox_purchasing_hub::::::::	before 1.0.2	Vulnerable	Redon

cpe:2.3:a:redon:roblox_purchasing_hub:*:*:*:*:*:*:*:* Versions before 1.0.2 Vulnerable ·Redon

Remediation

Fix · CNA Roblox-Purchasing-Hub (Redon-Tech) Fixed in 1.0.2

Timeline

2026-10-02 Threatist record created from CVE-2021-41191

References

Patch 1

https://github.com/Redon-Tech/Roblox-Purchasing-Hub/commit/58a22260eca40b1a0377daf61ccd8c4dc1440e03

Advisory 2

TI-2024-20806 Redon-Hub has incorrect permissions on all admin related commands CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences