Description

Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-06T09:17:53.730Z",
  "pubdate": "2026-10-06T09:17:53.730Z",
  "executiveSummary": "WXD Backup Lite versions 1.0.2 and earlier are susceptible to an unauthenticated broken access control vulnerability. This flaw resides within the application's authorization mechanism, allowing unauthorized entities to bypass security checks that should restrict sensitive functionality.\nThe vulnerability allows an unauthenticated attacker to interact with backend administrative or sensitive backup functions without providing valid session credentials. This bypass effectively negates the authentication layer of the product.\nThe impact includes potential unauthorized access to system backups, potential data exfiltration, and the ability to manipulate backup configurations. Given the nature of backup software, this vulnerability represents a significant risk to data confidentiality and integrity.\nExploitation requires network access to the target instance but does not necessitate prior authentication, making this a high-severity entry point for attackers to compromise managed data.",
  "technicalDetails": "The root cause of this vulnerability is an improperly implemented authorization check within the WXD Backup Lite application logic. Specifically, the software fails to validate the authentication state or authorization tokens for sensitive requests directed at core backup management endpoints.\nThe vulnerable component handles administrative requests by checking for the presence of certain parameters or specific HTTP headers, rather than verifying the integrity and legitimacy of an active session token issued by the authentication service. Because the application logic defaults to a 'permit' state when these checks are omitted or malformed, an attacker can directly invoke sensitive function handlers.\nThe attack flow begins with the attacker identifying the target URL endpoints associated with backup management or system configuration. By crafting direct HTTP requests to these endpoints, the attacker circumvents the standard login flow. Since the backend services do not re-validate the user's session state upon receiving these requests, the server process proceeds to execute the requested administrative operations with elevated privileges.\nThis vulnerability effectively exposes the entire administrative interface to the network. An attacker can leverage this to trigger unauthorized backup processes, list existing backup files, or potentially modify configuration files that govern the application's storage path. If the backup management functions include file download or upload capabilities, the attacker can move laterally to extract sensitive database contents or configuration backups stored by the application.\nThe vulnerability is confirmed in versions 1.0.2 and below. Because the flaw exists within the application's internal request processing architecture, it is independent of the underlying web server configuration. The exposure is global for any deployment where the management interface is reachable over a network, including those exposed to the public internet. No specific privilege requirements are needed to initiate the exploitation, as the system erroneously treats unauthenticated requests as authorized by default."
}