This vulnerability in Citrix Cloud allows a user with read-only access privileges to trigger the start of workflows designed for write operations. For example, the system may send a one-time password to an email address controlled by an attacker when the attacker attempts to reset a user's password. This indicates improper access control enforcement (CWE-284), where read-only accounts can perform actions beyond their intended permissions. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or remediation information is currently available, and no known exploits are reported in the wild.

An attacker with read-only access can initiate password reset workflows, potentially receiving one-time passwords at attacker-controlled email addresses. This can lead to unauthorized account takeover, compromising user accounts and potentially broader system security. The vulnerability impacts confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict read-only account permissions and monitor for unusual password reset activities. Avoid granting read-only access to untrusted users. Follow vendor updates closely for any released patches or official mitigations.