Authenticated API License Deactivation in CAXperts UPVWebServices

Executive Summary

This vulnerability exists in CAXperts UPVWebServices versions 2.4.2212.603 through 2.7.6 and UDiTH Portal versions 2026.0.0 through 2026.2.0. An authenticated remote user can access an administrative API endpoint that is intended only for privileged users. Because the application lacks proper authorization checks on this endpoint, the attacker can misuse it to deactivate the application's license.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an authenticated attacker can deactivate the application's license by invoking an administrative API endpoint without proper authorization. This could disrupt the normal operation of the affected software, potentially causing service interruptions or loss of functionality that depends on a valid license.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated remote user to deactivate the application's license by exploiting an administrative API endpoint due to missing authorization checks. This results in a denial of service but does not affect confidentiality or data integrity.

Since the vulnerability does not impact confidentiality or integrity of data, it is unlikely to directly cause non-compliance with data protection regulations such as GDPR or HIPAA, which primarily focus on protecting personal data privacy and security.

However, the denial of service caused by license deactivation could indirectly affect operational availability, which may be a consideration under some compliance frameworks that require system availability and reliability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated remote user invoking an administrative API endpoint without proper authorization checks. Detection would involve monitoring for unauthorized or unexpected calls to administrative API endpoints by users with low privileges.

Specific commands or detection methods are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should update their software to the fixed versions: UPVWebServices version 2.7.7 or later and UDiTH Portal version 2026.2.1 or later.

This update addresses the improper access control issue that allows low-privileged authenticated users to invoke administrative API endpoints and deactivate the application license.

Useful 0 Not Useful 0