A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449… (CVE-2026-38470)

The vulnerability in GazellePW's API user endpoint permits unprivileged authenticated users to perform enable or disable actions on arbitrary user accounts using the req=disable or req=enable parameters. This is due to broken access control that fails to restrict these actions to authorized users only. The flaw is identified as CWE-284 (Improper Access Control). The CVSS v3.1 base score is 4.3 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but limited integrity impact.

The vulnerability allows an authenticated user with a normal API token to arbitrarily enable or disable other user accounts. This can lead to unauthorized modification of user account states, impacting the integrity of the system's user management. There is no direct impact on confidentiality or availability reported.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API token permissions and monitor for unauthorized account status changes if possible.