CVE-2026-30269
Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/{username}. The role field is accepted by the update model without a manage_users permission check for self-updates, enabling privilege escalation to high-privileged roles.
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- web blog.orxiain.life