Oxygen Patches Critical Unauthenticated Access Flaw in Design Library Import Endpoints

Oxygen has released version 6.1.2 to remediate an access control vulnerability discovered during an internal security audit. The issue affected Oxygen 6.0 and later versions, where three Design Library import endpoints remained reachable without authentication. Consequently, unauthenticated remote visitors could supply arbitrary URLs for the server to fetch and persist the responses as global design data—specifically global CSS variables and selectors rendered across every page of the site. Oxygen 6.1.2 mitigates the vulnerability by enforcing administrator access across all three endpoints and validating target URLs prior to server fetches. This vulnerability represents a significant risk because it combines broken access control (BAC) with unauthorized state manipulation and potential server-side request forgery (SSRF). Because the imported design definitions are injected into every rendered page, an attacker could manipulate site appearance, deface properties, or stage client-side attacks through CSS injection without needing valid credentials. Organizations maintaining web assets on the affected builder framework must treat this as an urgent patch priority, as exploiting unauthenticated public endpoints requires minimal complexity once discovered. This incident mirrors a persistent trend across modern content and web application frameworks: backend convenience features, such as automated remote template and asset importers, frequently bypass baseline access controls and strict fetch validation. In the broader application security landscape, server-side URL fetching mechanisms represent a prime target for initial access and lateral data leakage. As development teams adopt modular component ecosystems, the boundaries between internal configuration management and public-facing endpoints often become blurred during feature refactoring, leading to authorization gaps. In practice, security engineers and site administrators running Oxygen 6.0+ should immediately upgrade to version 6.1.2 or later to eliminate exposure. Beyond applying the patch, application security teams should audit all API routes and background job workers that handle remote resource fetching, ensuring that mandatory authentication middleware is uniformly applied. Development workflows must also implement comprehensive test cases verifying that non-authenticated requests to administrative and import handlers fail closed, and outbound HTTP requests initiated by web servers are strictly restricted via egress filtering and URL allowlists.