Description

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-20T09:16:47.883Z",
  "pubdate": "2026-08-20T09:16:47.883Z",
  "executiveSummary": "An information disclosure vulnerability exists within the user management subsystem, specifically exposed via the endpoint /api/user/fetch-all.php. This security flaw allows a remote attacker with low-privileged access to systematically enumerate all configured user accounts and identify accounts possessing elevated privileges.\nThe impact of this vulnerability is significant from a reconnaissance perspective, as it facilitates targeted attacks against administrative and high-value accounts by stripping anonymity from the user base.\nThe affected system exposes sensitive account metadata without proper authorization enforcement, violating the principle of least privilege.\nThe risk implications include credential harvesting, targeted brute-force attacks, and social engineering campaigns directed against privileged users.\nThe attacker capabilities are limited to remote, low-privileged authentication, requiring network access to the target application interface to query the vulnerable endpoint.\nNo complex exploitation vectors are required, as the endpoint inherently returns the sensitive enumeration data upon receiving a valid request from a low-privileged session.",
  "technicalDetails": "The vulnerability resides in the server-side script located at /api/user/fetch-all.php, which fails to implement adequate access control checks to restrict the retrieval of comprehensive user data to authorized administrative roles.\nThe root cause is a failure of authorization enforcement, where the endpoint processes requests for user account collections without validating whether the requesting session possesses the requisite privilege level to view such sensitive data structures.\nThe vulnerable component is the user data retrieval API controller responsible for querying the backend database and serializing user account records into a response payload.\nExploitation occurs remotely over the network when an authenticated attacker with low privileges issues an HTTP request directly to the /api/user/fetch-all.php endpoint.\nUpon receiving the request, the server executes the underlying query or logic without scoping the output to the requesting user's permission tier.\nThe server subsequently responds with a comprehensive payload containing serialized user records, which typically include account identifiers, usernames, and associated privilege levels or role assignments.\nThe attacker parses the resulting response payload to extract the complete list of configured users and filters the data to isolate accounts flagged with elevated privileges, such as administrators or system operators.\nThis harvested intelligence forms the foundation for subsequent post-exploitation activities, allowing the adversary to focus advanced attack vectors exclusively on high-value targets rather than expending resources on low-value or service accounts."
}