CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Pravin Durugkar User Sync ActiveCampaign registered-user-sync-activecampaign allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Sync ActiveCampaign: from n/a through <= 1.3.2.
Explanation of Vulnerability in Simple Terms
User Sync ActiveCampaign versions 1.3.2 and earlier lack proper authorization checks, allowing authenticated users to modify or disable functionality they should not have access to. An attacker with low-level credentials can alter data integrity or disrupt service availability. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Modify or disable features and data without proper authorization.
Potential impact on your site
Authenticated users can tamper with sync settings or data, potentially disrupting ActiveCampaign integration.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
