CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through <= 4.12.0.
Explanation of Vulnerability in Simple Terms
Total Poll Lite versions 4.12.0 and earlier lack proper authorization checks, allowing authenticated users to access sensitive poll data and functionality they should not have permission to view or modify. An attacker with a low-privilege account can read confidential poll information without additional interaction. Update to a version newer than 4.12.0 to resolve this issue.
What an attacker can do
Read sensitive poll data and functionality restricted to higher-privilege users.
Potential impact on your site
Confidential poll data may be exposed to users who should not have access to it.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
