This vulnerability in MphRx Minerva 3.6.0 is an insecure direct object reference (IDOR) classified under CWE-284 (Improper Access Control). It occurs in the user profile update API endpoint, which does not properly restrict access to user data. Authenticated users can modify other users' profile details, including email addresses. By changing the email, an attacker can trigger a password reset process to gain control over the victim's account. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not provided a patch or official remediation level, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows an authenticated attacker to modify other users' profile information, including email addresses, which can be leveraged to reset passwords and take over accounts. This compromises user confidentiality, integrity, and availability, potentially leading to full account takeover. The vulnerability is rated critical with a CVSS score of 9.4, reflecting the severe impact on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable endpoint by implementing additional access controls or monitoring authenticated user actions related to profile updates. Consider disabling or limiting the password reset functionality if feasible. Monitor for unusual account modification activities. Avoid granting unnecessary privileges to users to reduce risk.