SENAITE.CORE Unauthenticated RCE in JSON API

SENAITE.CORE, the core framework for the SENAITE laboratory information management system, is affected.

From version 2.0.0 to 2.6.0, the JSON API permits unauthenticated remote code execution through a two-request chain.

The issue lies in missing authorization checks for state-changing routes and unsafe evaluation of raw request values.

An attacker can exploit this to execute arbitrary Python code, exposing or modifying laboratory data, files, and accounts, and potentially disrupting the service.