BraveCMS versions before 2.0.6 contain a missing authorization vulnerability (CWE-862) in the update role endpoint defined in routes/web.php. Specifically, the POST route /rights/update-role/{id} lacks the middleware checkUserPermissions:assign-user-roles, which should restrict role assignment actions. As a result, any authenticated user can exploit this flaw to change account roles arbitrarily, including promoting themselves to Super Admin. This privilege escalation vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. The issue is resolved in version 2.0.6 of BraveCMS.

Exploitation of this vulnerability allows an authenticated user to bypass authorization controls and escalate their privileges to Super Admin. This can lead to full system compromise, including unauthorized access to sensitive data, modification of content, and disruption of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of the affected system.

Upgrade BraveCMS to version 2.0.6 or later, where this missing authorization check has been fixed. Since the vulnerability is resolved in this version, applying the official update is the recommended remediation. No other mitigation or temporary workaround is documented.