Description

Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T13:16:56.993Z",
  "pubdate": "2026-08-27T13:16:56.993Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in Summit Security Systems AdisyonPro, versions prior to 5.21.0, originating from the improper handling of user-controlled keys within application requests.\nThis security flaw allows remote, unauthenticated, or low-privileged attackers to access sensitive functionality that should be restricted by Access Control Lists (ACLs).\nBy manipulating the user-controlled key, an attacker can effectively circumvent the intended security boundaries of the application, leading to unauthorized actions, potential data exfiltration, or unauthorized administrative operations.\nThe risk is classified as high, as it enables attackers to interact with core application features that are intended to be protected, bypassing standard authorization checks that govern user permissions.\nNo specific preconditions beyond reaching the vulnerable endpoint are required for exploitation, making it a significant concern for installations exposed to the network.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of access control checks where the application trusts a user-supplied key to authorize access to specific features.\nInstead of validating the session context or mapping the user's role against a server-side ACL, the application relies on an easily manipulated parameter provided by the client side.\nWhen a request is made to a protected endpoint, the backend process fails to perform secondary validation on the requested functionality. An attacker can perform a direct object reference or parameter manipulation attack by substituting, injecting, or tampering with the user-controlled key in the request header or body.\nThe attack flow proceeds as follows: First, the attacker identifies the parameter or key used by the application to gate-keep specific functions. Second, the attacker manipulates this parameter to map to an authorized function or resource ID for which they do not possess legitimate permissions.\nThe vulnerable component in AdisyonPro fails to enforce mandatory authorization checks at the server level, treating the user-supplied key as the authoritative source of truth for access rights. This essentially creates a bypass mechanism where the backend assumes that the presence of a properly formatted (or guessed) key is sufficient proof of authorization.\nExploitation does not require advanced technical knowledge, as the pattern of the key may be predictable, allowing for iterative brute-forcing or direct injection into API endpoints or web request parameters.\nBecause the system fails to verify that the current user context (associated with a valid session) holds the necessary privileges to perform the requested operation, the server executes the command or returns the requested data regardless of the attacker's actual role.\nThe post-exploitation impact includes full unauthorized access to restricted features, potential modification of system settings, unauthorized data access, or the ability to perform administrative actions, severely undermining the integrity and confidentiality of the AdisyonPro deployment.\nAffected versions are confirmed as all releases prior to 5.21.0."
}