CVE-2024-0795
Create user API role not enforced
Summary
Create user API role not enforced
Original description
The description as published by the source.
If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an admin role and then be able to use this new account to have elevated privileges on the instance
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com