CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Mayeenul Islam NanoSupport nanosupport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NanoSupport: from n/a through <= 0.6.0.
Explanation of Vulnerability in Simple Terms
NanoSupport versions 0.6.0 and earlier lack proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter records through the application's API or interface without additional restrictions. This affects the integrity of stored information but does not expose sensitive data or disrupt availability.
What an attacker can do
Modify data or records belonging to other users or the system without proper authorization.
Potential impact on your site
Unauthorized changes to support tickets, user data, or configuration by authenticated users with limited roles.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the NanoSupport installation.
Key dates
External resources
Related vulnerabilities
