CVE-2024-24573 HIGH

CVE-2024-24573: facileManager Privilege Escalation via Mass Assignment

Vendor Willyxj
Product facileManager
Weakness CWE-863 · Incorrect authorization
Published January 31, 2024
Last update June 16, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.

Key dates

02Disclosure timeline

January 31, 2024 CVE published
June 16, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-33576 OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel CVE-2026-40350 Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts CVE-2025-40897 Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0 CVE-2025-14318 Improper access validation in M-Files Server CVE-2026-13508 khoj-ai khoj Conversation Sharing api_chat.py authorization