CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe to Category: from n/a through 2.7.4.
Explanation of Vulnerability in Simple Terms
Subscribe to Category contains an authorization flaw that allows authenticated users to access sensitive information they should not be able to view. A logged-in user with low privileges can read data restricted to higher-privilege accounts without additional interaction. The vulnerability affects versions up to 2.7.4. Update to a version newer than 2.7.4 to resolve this issue.
What an attacker can do
Read sensitive data belonging to other users or restricted areas of the site.
Potential impact on your site
Authenticated users can view information they should not have access to, risking data exposure.
Conditions required to exploit
Attacker must have a valid login account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
