CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 2.6.2.
Explanation of Vulnerability in Simple Terms
New User Approve versions 2.6.2 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read or modify data they should not access. The vulnerability requires a valid user account but no special interaction. Site administrators should update to a version newer than 2.6.2 to prevent unauthorized data exposure or modification.
What an attacker can do
Read or modify data belonging to other users or the site without proper authorization.
Potential impact on your site
Unauthorized users can access or alter sensitive information, compromising data integrity and user privacy.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
