CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Roam: from n/a through <= 2.1.1.
Explanation of Vulnerability in Simple Terms
Roam versions up to 2.1.1 contain an authorization flaw that allows high-privilege users to read and modify sensitive data. The vulnerability requires administrator-level access and does not affect data availability. A patch version has not been publicly identified.
What an attacker can do
Read and modify sensitive data within the application.
Potential impact on your site
Administrators with malicious intent or compromised admin accounts can access and alter sensitive information.
Conditions required to exploit
Attacker must have high-level administrative privileges on the site.
Key dates
External resources
