This vulnerability (CWE-943) affects BeyondTrust Remote Support and Privileged Remote Access by insufficiently validating user-supplied input parameters in the web application. This improper neutralization of special elements in data query logic may enable an authenticated attacker with limited privileges to escalate access and retrieve unintended resources or data outside their authorized scope. The vulnerability requires the attacker to have an account with certain permissions, limiting exploitation to those users. The CVSS 4.0 base score is 8.5, indicating high severity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with limited privileges and specific permissions can exploit this vulnerability to access unauthorized resources or data within the BeyondTrust Remote Support environment. This could lead to unauthorized data disclosure or access control bypass within the affected application. There is no indication of remote code execution or system-level compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, organizations should monitor BeyondTrust advisories for updates. Restricting user permissions to the minimum necessary may reduce risk until a fix is available.