Executive Summary

This vulnerability in SOPlanning allows users with the user_manage_team role to escalate their privileges to administrative level. Although these users are supposed to only manage team permissions, they can assign administrative permissions to themselves or others, exploiting both the Bulk Update functionality and regular user rights editing. This means an authenticated user with limited permissions can gain full admin control.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized privilege escalation, allowing a user with limited permissions to gain administrative access. This can result in unauthorized changes, data exposure, or control over the system, potentially compromising the security and integrity of the affected environment.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SOPlanning to version 1.55 or later, as this issue was fixed in that version. Additionally, review and restrict the assignment of the user_manage_team role to trusted users only to prevent unauthorized privilege escalation.

Useful 0 Not Useful 0