Insecure Direct Object Reference in Crafty Controller Users API

Executive Summary

CVE-2026-5652 is an Insecure Direct Object Reference (IDOR) vulnerability in the Users API component of Crafty Controller version 4.10.2. It occurs in the PATCH /api/v2/users/{user_id} endpoint, where the system improperly validates API permissions.

Specifically, a user with USER_CONFIG permission can modify or disable any other user's account, including administrators and managers outside their management scope, because the endpoint only checks if the requester has USER_CONFIG permission but does not verify if the requester manages the target user.

This allows an attacker to send a PATCH request with an arbitrary user ID and set the "enabled" field to false, effectively locking out other users from the system. The expected behavior is that the system should enforce management checks and reject unauthorized modifications with a 403 Forbidden response.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized PATCH requests to the /api/v2/users/{user_id} endpoint where the "enabled" field is being modified. Specifically, look for PATCH requests made by users with USER_CONFIG permission that attempt to disable other users' accounts.

A detection approach involves authenticating as a user with USER_CONFIG permission and checking if they can modify other users outside their management scope. You can also inspect logs or network traffic for suspicious PATCH requests that include JSON bodies like {"enabled": false} targeting arbitrary user IDs.

Example commands to test or detect the vulnerability include:

• Authenticate as a USER_CONFIG user to obtain a Bearer token.
• Use a GET request to list users and obtain victim user IDs: curl -H "Authorization: Bearer <token>" https://<crafty-controller>/api/v2/users
• Send a PATCH request to disable a user account: curl -X PATCH -H "Authorization: Bearer <token>" -H "Content-Type: application/json" -d '{"enabled": false}' https://<crafty-controller>/api/v2/users/<victim_user_id>

If the PATCH request succeeds in disabling a user outside the requester's management scope, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact by allowing an attacker with USER_CONFIG permission to disable or modify any user account, including those of administrators and managers.

Such unauthorized modifications can disrupt normal user operations, block access to the application for critical users, and potentially cause denial of service within the system by locking out key personnel.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user with USER_CONFIG permission to disable or modify other users' accounts, including administrators, without proper authorization checks. This can lead to unauthorized access control changes and potential denial of service for legitimate users.

Such unauthorized modifications and potential disruption of user accounts could impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls, user data protection, and accountability for user management actions.

Specifically, the failure to enforce proper permission validation may violate principles of least privilege and proper user authorization, increasing the risk of data breaches or service interruptions that these regulations aim to prevent.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting USER_CONFIG permission to only trusted users and monitoring API usage closely.

Ensure that only users who must manage other users have USER_CONFIG permission, and audit existing users with this permission.

If possible, apply any available patches or updates from the vendor that fix the improper permission validation in the PATCH /api/v2/users/{user_id} endpoint.

As a temporary workaround, consider implementing network-level controls or API gateway rules to block PATCH requests that attempt to disable users unless properly authorized.

Useful 0 Not Useful 0