This vulnerability in Doorman v0.1.0 and v1.0.2 involves improper access control where authenticated users can modify their own account roles through the /platform/user/{username} API endpoint. The update model accepts the 'role' field without enforcing a permission check for managing users, allowing users to escalate their privileges to roles with higher privileges than intended. No CVSS score or official remediation details are currently available.

Exploitation of this vulnerability allows authenticated users to escalate their privileges to non-admin but high-privileged roles, potentially granting them unauthorized access to sensitive functions or data within the application. This could lead to unauthorized actions being performed under elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint and monitor for suspicious role changes. Implement additional access control checks on the 'role' field in user update operations to prevent unauthorized privilege escalation.