CVE-2024-25653 is a broken access control vulnerability identified in the Report functionality of Delinea PAM Secret Server version 11.4. The vulnerability arises when the Unlimited Admin Mode feature is enabled, which inadvertently grants unprivileged users the ability to access and modify system reports via the web user interface. This bypasses intended access restrictions, allowing these users to view sensitive system reports and alter custom reports without proper authorization. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 4.3, indicating a medium severity level. The attack vector is network-based (AV:N), requires low attack complexity (AC:L), and privileges are required (PR:L), but no user interaction is necessary (UI:N). The scope remains unchanged (S:U), and the impact affects confidentiality (C:L) but not integrity (I:N) or availability (A:N). There are no known exploits in the wild at this time, and no specific patches have been linked yet. This vulnerability could allow attackers with limited privileges to gain unauthorized visibility into sensitive reports and potentially manipulate reporting data, which could aid in further reconnaissance or mislead administrators.

The primary impact of CVE-2024-25653 is the unauthorized disclosure of sensitive information contained within system reports, which could include privileged credential usage, system configurations, or audit logs. This breach of confidentiality could facilitate further attacks by providing adversaries with valuable intelligence about the environment. Although the vulnerability does not directly affect system integrity or availability, the ability to modify custom reports could be leveraged to obscure malicious activities or misinform security teams. Organizations relying on Delinea PAM Secret Server for privileged access management could face increased risk of insider threat exploitation or external attackers escalating privileges by abusing report access. The risk is heightened in environments where Unlimited Admin Mode is enabled broadly or without strict access controls, potentially exposing critical infrastructure and sensitive data.

To mitigate CVE-2024-25653, organizations should first verify whether Unlimited Admin Mode is enabled in their Delinea PAM Secret Server deployments and assess the necessity of this mode. If possible, disable Unlimited Admin Mode or restrict it to only highly trusted administrators. Implement strict role-based access controls (RBAC) to limit report viewing and modification privileges to authorized personnel only. Monitor and audit report access logs regularly to detect any unauthorized access attempts. Until an official patch is released, consider isolating the PAM server from untrusted networks and enforcing network segmentation to reduce exposure. Engage with Delinea support for updates or patches addressing this vulnerability and apply them promptly once available. Additionally, conduct security awareness training for administrators to recognize and respond to suspicious report modifications or access patterns.