PelicanPlatform's pelican product contains an incorrect authorization vulnerability (CWE-863) in its Web User Interface that affects versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2. Authenticated users via OAuth can escalate privileges to admin under certain configurations. The vulnerability has been addressed in versions 7.21.5, 7.22.3, 7.23.3, and 7.24.2. The CVSS 4.0 base score is 9.0, indicating a critical severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An authenticated user with low privileges on the Pelican WebUI can escalate to admin privileges, potentially gaining full control over the platform. This could lead to unauthorized access to sensitive data and administrative functions. The vulnerability affects multiple versions before the patched releases. No known exploits in the wild have been reported at this time.

This vulnerability has been patched in Pelican versions 7.21.5, 7.22.3, 7.23.3, and 7.24.2. Users should upgrade to one of these fixed versions to remediate the issue. Since this is not a cloud service, remediation depends on applying the official patches. Patch status is confirmed by the vendor advisory information embedded in the description.