CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through <= 1.2.6.
Explanation of Vulnerability in Simple Terms
User Roles and Capabilities versions 1.2.6 and earlier contain a missing authorization check that allows authenticated users to access sensitive information they should not have permission to view. An attacker with a low-privilege account can read data restricted to higher-privilege roles without additional interaction. The vulnerability affects confidentiality but not data integrity or availability.
What an attacker can do
Read sensitive data restricted to higher-privilege user roles.
Potential impact on your site
Users with low privileges can view information meant only for administrators or other restricted roles.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
