Summary

The notifications_api_controller.rb bulk endpoints (open_all and destroy_all) pass unfiltered request parameters to filtered_by_options, which passes a custom_filter value directly to ActiveRecord's where() as a raw SQL string. An unauthenticated attacker can inject arbitrary SQL conditions, enabling mass data modification, mass data deletion, and information disclosure via boolean-based exfiltration.