The vulnerability arises from a missing authorization check in the POST /api/users/~/{user}/tokens endpoint of the Qt Axivion Dashboard API. The endpoint allows creation of API tokens for other users without verifying that the requester has sufficient permissions. Exploitation requires the attacker to authenticate via OAuth/OIDC and know the login name of a more privileged internal user. By forging a token creation request on behalf of that user and completing the process with their own credentials, the attacker could escalate privileges to Dashboard Administrator. This escalation could enable all administrative actions and, combined with other weaknesses, might lead to remote code execution on the host system running the Dashboard.

Successful exploitation allows an attacker with limited privileges and valid authentication to impersonate a more privileged internal user by creating API tokens on their behalf. This can lead to full administrative control over the Dashboard, enabling all administrative functions. In worst-case scenarios, this privilege escalation could be leveraged to execute arbitrary code on the host system with the operating system user privileges of the Dashboard server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the Dashboard API to trusted users only and monitor for suspicious token creation activities. Review OAuth/OIDC authentication configurations to limit exposure. Follow vendor updates closely for an official fix.