CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Yehi Advanced Notifications advanced-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Notifications: from n/a through <= 1.2.7.
Explanation of Vulnerability in Simple Terms
Advanced Notifications versions 1.2.7 and earlier lack proper authorization checks, allowing authenticated users to modify notification settings they should not have access to. An attacker with a low-privilege account can alter integrity of notification configurations. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Modify notification settings or configurations belonging to other users or the system.
Potential impact on your site
Unauthorized users can tamper with notification settings, potentially disrupting communications or altering system behavior.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
