CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RTMKit: from n/a through <= 1.6.7.
Explanation of Vulnerability in Simple Terms
RTMKit versions up to 1.6.7 contain an authorization flaw that allows authenticated users to read sensitive data they should not access. The vulnerability requires a valid user account but no special privileges. An attacker with low-level access can retrieve confidential information from the application.
What an attacker can do
Read sensitive data belonging to other users or the application.
Potential impact on your site
User data and confidential information may be exposed to authenticated attackers with basic access.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
