This vulnerability (CVE-2026-5781) in MphRx Minerva 3.6.0 involves improper authorization (CWE-285) in the '/minerva/moUser/update' endpoint. Specifically, an authenticated user who already has user modification privileges can escalate to administrator privileges by sending a crafted HTTP request with a manipulated 'identifier' field. The issue does not allow privilege escalation via the graphical user interface, indicating the flaw is in the backend API authorization checks. The CVSS 4.0 base score is 8.5, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not provided a patch or official remediation level, and this is not a cloud service, so remediation depends on vendor updates or workarounds.

Successful exploitation allows an authenticated user with user modification privileges to gain administrator privileges, potentially leading to full system control. This could compromise system confidentiality, integrity, and availability. The vulnerability does not allow privilege escalation through the graphical user interface, limiting exploitation to crafted HTTP requests. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user modification privileges to trusted users only and monitor for unusual API requests targeting the '/minerva/moUser/update' endpoint. Avoid granting unnecessary privileges to users. Follow vendor communications for updates on patches or official mitigations.