Description

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T09:16:47.307Z",
  "pubdate": "2026-08-20T09:16:47.307Z",
  "executiveSummary": "An improper authorization vulnerability exists within the user creation functionality of the application. Specifically, a low-privileged remote attacker with a valid session can exploit this flaw to create new user accounts assigned with arbitrary role values, including the highest privilege level utilized by the system.\nThe vulnerability allows unauthorized privilege escalation, posing a severe risk to application integrity and confidentiality. By manipulating the parameters during the user creation process, a low-privileged user can effectively bypass access controls and provision administrative accounts.\nThe affected component is exposed via the web interface at /api/user/add.php. Successful exploitation requires network connectivity, a valid low-privileged user session, and the ability to submit HTTP requests containing modified role parameters to the vulnerable endpoint.\nThe business impact includes complete compromise of the application, unauthorized access to sensitive data, and potential takeover of the underlying system if administrative privileges are leveraged maliciously.",
  "technicalDetails": "The vulnerability stems from a lack of server-side validation and authorization checks regarding the assignment of user roles during the account creation process. When requests are submitted to /api/user/add.php, the application fails to restrict the role parameter values that a low-privileged user is allowed to assign to newly created accounts.\nThe attack vector is network-based and exposed via the HTTP endpoint /api/user/add.php. Exploitation requires the attacker to possess a valid low-privileged user session to authenticate to the application. The privilege requirement for the initial session is low, but the resulting impact allows for the attainment of the highest privilege level.\nThe attack flow proceeds as follows: First, the authenticated low-privileged attacker intercepts or constructs an HTTP request destined for /api/user/add.php. Second, the attacker modifies the payload within the request to include an arbitrary, elevated role value (such as administrator or the application's highest privilege level) in the user creation parameters. Third, the attacker transmits the crafted request to the server. Fourth, the vulnerable endpoint processes the input without enforcing proper role-based access control (RBAC) or input validation. Finally, the application successfully creates the new account with the requested high-privilege role, granting the attacker full administrative access upon subsequent authentication.\nThe root cause is insufficient server-side validation of privilege levels and the absence of boundary checks ensuring that users can only assign roles equal to or lower than their own authorized privilege level. The payload behavior involves injecting unauthorized role identifiers into the account creation request data structure, which the backend logic blindly accepts and commits to the database or session store.\nThe post-exploitation impact includes full system compromise, unauthorized data exfiltration, modification or deletion of critical data, and potential execution of administrative functions across the application."
}