GHSA-8rnw-fx2p-p2q7: Privilege Escalation via Manager Role to Admin Role Assignment

Privilege escalation via Manager-role user creation and role assignment Vulnerability Overview Vulnerability ID: GHSA-8rnw-fx2p-p2q7 Severity: High (8.8 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High Description: A user with Manager role access can create new user accounts and assign them the Admin role, thereby elevating privileges beyond what the role hierarchy intends. Details: The and operations are gated only at the level via prefix matching on within the , rather than being checked at the Admin level. Role assignment is directly bound to the object in the request parameters via Graal's default data binding. Consequently, a user with the Manager role—intended for inventory management staff rather than administrators—can create a new account, set its role to Admin, and then authenticate as that account. Impact: Any user with the Manager role can escalate to full administrative privileges, including the ability to create persistent accounts with admin rights. Affected Versions: v0.9.7-hoffux1 and earlier. Fix: Instead of simply adding these operations to an admin-only whitelist, the role assignment logic was refactored to extract the role ID within the controller and explicitly pass it to the service, rather than leaving it in the request parameters where Graal's data binding could apply it. The service now rejects any request parameters that still carry role-shaped keys and centralizes the actual permission checks (which roles can be added or removed) into dedicated methods used by each code path capable of changing role assignments. Fixed in v0.9.8. Patch: #5948

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-8rnw-fx2p-p2q7: Privilege Escalation via Manager Role to Admin Role Assignment

More from this source