CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in icegram Icegram Collect plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect plugin: from n/a through 1.3.14.
Explanation of Vulnerability in Simple Terms
Icegram Collect versions up to 1.3.14 lack proper authorization checks, allowing authenticated users with low privileges to modify or delete data they should not have access to. An attacker with a basic user account can perform unauthorized actions that affect site integrity. The vulnerability requires valid login credentials but no special privileges or user interaction beyond normal API calls.
What an attacker can do
Modify or delete data without proper authorization using a low-privilege user account.
Potential impact on your site
Unauthorized users can alter or remove form submissions, settings, or other data managed by Icegram Collect.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
