Description

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T13:06:07.447Z",
  "pubdate": "2026-09-03T13:06:07.447Z",
  "executiveSummary": "Dell PowerProtect Data Manager versions 20.2.0.0 and below are susceptible to an Incorrect Authorization vulnerability within the REST API component.\nThe vulnerability enables a remote attacker with low privileges to bypass established protection mechanisms, potentially resulting in unauthorized access or operations that should be restricted based on the user's assigned role.\nThis flaw originates from improper validation of authorization logic when handling specific REST API requests, allowing the circumvention of security controls.\nThe attack is remote in nature and does not require elevated administrative privileges, lowering the barrier for exploitation.\nSuccessful exploitation compromises the integrity and confidentiality of the data management system, as the attacker can perform actions beyond their authorized scope.\nOrganizations using affected versions of Dell PowerProtect Data Manager are at risk of security policy subversion and unauthorized resource interaction.",
  "technicalDetails": "The vulnerability is classified as an Incorrect Authorization issue, specifically involving the REST API interface of Dell PowerProtect Data Manager in versions 20.2.0.0 and earlier.\nThe root cause lies in the insufficient enforcement of authorization checks when the application processes incoming REST API calls. The system fails to correctly verify whether the authenticated user possesses the necessary permissions to execute specific API endpoints or perform restricted operations.\nBecause the application logic does not properly validate the authorization context of the request, an attacker can manipulate API parameters or headers to access endpoints reserved for higher-privileged accounts.\nThe attack flow begins with the attacker establishing a network connection to the target Dell PowerProtect Data Manager instance. Utilizing a low-privileged account, the attacker identifies specific REST API endpoints that lack robust server-side authorization controls.\nThe attacker then crafts a malicious request targeting these vulnerable endpoints. Due to the lack of adequate validation, the REST API interface incorrectly processes the request, assuming the caller has the required authorization, thereby bypassing the intended security access control list.\nThis behavior allows the attacker to execute unauthorized commands or perform data management tasks that should have been blocked. The impact of this bypass can lead to unauthorized configuration changes, data exposure, or the manipulation of protection policies.\nThe exploit is highly efficient as it operates at the API layer, potentially interacting with backend resources without triggering traditional application-level security monitoring that assumes standard user behavior. The vulnerability persists because the authorization logic is loosely coupled with the API request handling process, failing to maintain a 'deny-by-default' posture for non-privileged requestors.\nExposure is primarily over the network, as the REST API is typically reachable via HTTPS, and the flaw does not necessitate specialized hardware or physical access to the server, making it a viable target for remote malicious actors attempting to escalate their impact within the management ecosystem."
}