Privilege Escalation in Axelor Open Platform

Executive Summary

CVE-2026-63085 is an authorization bypass vulnerability in Axelor Open Platform versions 8.x before 8.2.2. It allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions during nested relational save operations. Attackers can modify sensitive User record fields like roles and groups through a related entity's save path, bypassing the USER_RESTRICTED_FIELDS control. The JPA persistence layer then applies these admin role assignments upon commit.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized privilege escalations in User records. Check for non-admin users modifying roles or groups via nested relational saves. Review application logs for suspicious save operations on related entities like Team.members that include User field changes. Look for unexpected admin role assignments or group modifications in User records.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows non-admin users to gain admin-level access by modifying User records through indirect paths. Attackers could assign themselves or others admin roles and groups, potentially taking full control of the system. This could lead to unauthorized data access, system manipulation, or complete compromise of the Axelor Open Platform instance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires strict access controls and data protection measures, while HIPAA mandates role-based access controls for protected health information. A privilege escalation flaw like this could result in unauthorized data exposure, violating these regulations and potentially leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to Axelor Open Platform version 8.2.2 or later to patch the vulnerability. Review and restrict write permissions on User records for non-admin users. Audit User records for unauthorized privilege changes and revert any suspicious admin role assignments. Monitor for unusual nested relational save operations involving User fields.

Useful 0 Not Useful 0