CVE-2026-5251: Dynamically-Determined Object Attributes in z-9527 admin
A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
This vulnerability in z-9527 admin 1.0 and 2.0 involves the User Update Endpoint implemented in /server/routes/user.js. By manipulating the isAdmin argument with the input value 1, an attacker can cause dynamically-determined object attributes, potentially altering user privileges or behavior. The vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not provided any response or patch, and no official remediation guidance is available.
Potential Impact
Successful exploitation may allow an attacker to manipulate user attributes remotely, potentially escalating privileges or altering user roles. The exact impact is limited to the affected component and depends on how the dynamically-determined attributes are used within the application. No confirmed exploitation in the wild has been reported.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no patch links exist, users should monitor vendor channels for updates. Until a fix is released, restricting access to the User Update Endpoint and implementing additional access controls or input validation may help reduce risk.
CVE-2026-5251: Dynamically-Determined Object Attributes in z-9527 admin
Description
A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in z-9527 admin 1.0 and 2.0 involves the User Update Endpoint implemented in /server/routes/user.js. By manipulating the isAdmin argument with the input value 1, an attacker can cause dynamically-determined object attributes, potentially altering user privileges or behavior. The vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not provided any response or patch, and no official remediation guidance is available.
Potential Impact
Successful exploitation may allow an attacker to manipulate user attributes remotely, potentially escalating privileges or altering user roles. The exact impact is limited to the affected component and depends on how the dynamically-determined attributes are used within the application. No confirmed exploitation in the wild has been reported.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no patch links exist, users should monitor vendor channels for updates. Until a fix is released, restricting access to the User Update Endpoint and implementing additional access controls or input validation may help reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-03-31T16:11:37.477Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69cc889de6bfc5ba1d8929e4
Added to database: 4/1/2026, 2:53:17 AM
Last enriched: 4/8/2026, 4:16:18 AM
Last updated: 5/15/2026, 1:13:12 AM
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.