Description

Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T14:16:56.763Z",
  "pubdate": "2026-08-13T14:16:56.763Z",
  "executiveSummary": "An unauthenticated privilege escalation vulnerability has been identified in the MStore API in versions 4.20.0 and prior. This security flaw allows unauthenticated remote threat actors to elevate their access privileges within the affected application context without requiring valid credentials or prior interaction.\nThe primary impact of this vulnerability is the potential complete compromise of authorization controls, enabling attackers to execute privileged API functions, access restricted administrative endpoints, and potentially manipulate underlying system data or user accounts.\nThe affected product is the MStore API across all versions up to and including 4.20.0. The risk implications are severe, as exploitation requires zero authentication overhead, significantly lowering the barrier to entry for malicious actors targeting exposed instances over the network.\nSuccessful exploitation grants unauthorized users elevated privileges, bypassing standard access control enforcement mechanisms embedded within the API routing or controller logic.",
  "technicalDetails": "The root cause of this vulnerability stems from improper access control validation within the MStore API codebase for versions <= 4.20.0. Specifically, endpoints or functional logic responsible for handling user roles, session generation, or administrative actions fail to adequately verify whether the incoming request originates from an authenticated and appropriately authorized session context.\nExploitation occurs over the network where an unauthenticated attacker transmits crafted HTTP requests directly to vulnerable API routes. Because the application logic lacks proper authorization checks, it processes the request and improperly grants elevated privileges or executes restricted actions intended solely for administrative or higher-privileged users.\nThe vulnerable component resides within the MStore API routing and permission-checking middleware or controller functions. The flaw allows attackers to bypass authentication entirely due to missing or flawed security checks on sensitive endpoints.\nThe attack flow proceeds as follows: First, the attacker identifies exposed MStore API endpoints susceptible to privilege escalation. Second, the attacker crafts a specialized HTTP request designed to trigger administrative functionality or force privilege assignment. Third, the API endpoint processes the request without validating the caller's authentication state or role assignment. Finally, the server responds with success codes or grants elevated session tokens, allowing the attacker to perform unauthorized post-exploitation actions.\nThe vulnerability requires no authentication and no prior privileges, and it is fully exploitable via network exposure if the API endpoints are reachable by the attacker. Post-exploitation impact includes full unauthorized control over affected application features, data exfiltration, and potential unauthorized modifications."
}