Description

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T14:20:20.147Z",
  "pubdate": "2026-08-17T14:20:20.147Z",
  "executiveSummary": "A Missing Authorization vulnerability has been identified in Dolusoft Software Technologies Sonlogger, specifically impacting the Access Control List (ACL) enforcement mechanisms. This security flaw allows remote authenticated or unauthenticated actors, depending on the specific endpoint exposure, to bypass intended authorization checks and directly access sensitive administrative or functional capabilities that should be properly constrained by ACLs. The vulnerability affects Sonlogger versions ranging from v6.6.6 prior to version 6.7.4.8. Successful exploitation of this flaw can lead to unauthorized access to restricted application features, potentially resulting in unauthorized data exposure, configuration tampering, or broader system compromise depending on the targeted functions. The root cause stems from insufficient validation of user roles and permissions within the request handling pipeline of the affected product. Attackers capable of crafting HTTP requests targeting unprotected functional routes can abuse this flaw without meeting the prerequisite privilege levels normally enforced by the software. Remediation requires upgrading Sonlogger to version 6.7.4.8 or later, where proper authorization checks and ACL enforcement are implemented across all sensitive endpoints.",
  "technicalDetails": "The vulnerability is classified as a Missing Authorization flaw, corresponding to a failure in properly constraining application functionality through Access Control Lists (ACLs). In the affected versions of Sonlogger (v6.6.6 up to, but not including, 6.7.4.8), the underlying application logic fails to adequately verify whether an incoming requestor possesses the requisite permissions or roles before executing sensitive backend functions or rendering restricted endpoints.\nRoot Cause Analysis: The core architectural deficiency lies in the routing and controller layers of the application, where functional handlers lack rigorous middleware or programmatic checks validating the session's privilege level against the requested resource. Instead of enforcing a mandatory, centralized authorization matrix, the software relies on implicit trust or client-side UI hiding, leaving the underlying API routes and controller methods directly accessible to any entity capable of transmitting a valid HTTP request to the server.\nAttack Vector and Flow: An attacker exploits this vulnerability by performing reconnaissance to identify sensitive functional URLs or API endpoints within the Sonlogger application. Once identified, the attacker crafts direct HTTP requests (such as GET or POST methods) aimed at these restricted endpoints. Because the application fails to validate the access control context during request dispatch, the backend processes the request and executes the privileged functionality. The attacker is thereby able to invoke administrative actions, bypass workflow restrictions, or access restricted data views without authenticating or by leveraging a low-privilege user session.\nVulnerable Component and Scope: The vulnerable component encompasses the endpoint routing and controller logic of Sonlogger within versions from v6.6.6 before 6.7.4.8. The network exposure is dictated by the deployment architecture of the Sonlogger instance, typically accessible via standard HTTP/HTTPS protocols over corporate or public networks. The exploitation does not inherently require advanced cryptographic attacks or memory corruption primitives; rather, it abuses logical flaws in state validation and access control enforcement."
}