The dataspace-portal, an open-source SaaS for Dataspace management by sovity, contained a critical authorization vulnerability (CWE-602, CWE-863) in versions 2.1.1 through before 7.3.2. Specifically, the backend did not properly enforce authorization for self-registered accounts in a "PENDING" state, relying instead on client-side enforcement which can be bypassed. This allows attackers to potentially gain unauthorized access or escalate privileges. The vulnerability is fixed in version 7.3.2.

The vulnerability allows unauthorized users to bypass backend authorization controls for self-registered "PENDING" accounts, potentially leading to unauthorized access or privilege escalation within the dataspace-portal environment. Given the critical CVSS score of 10, the impact is severe if exploited. However, no known exploits have been reported in the wild so far.

Upgrade to dataspace-portal version 7.3.2 or later, where this authorization issue has been patched. Since the vendor advisory confirms the fix in version 7.3.2, applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.