CVE-2026-63085 is an authorization bypass vulnerability in Axelor Open Platform 8.0.0 that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions during nested relational save operations. Attackers can submit changes through related entity save paths to modify sensitive User record fields like roles and groups, bypassing USER_RESTRICTED_FIELDS controls. This leads to the JPA persistence layer committing unauthorized admin role and group assignments on transaction commit. The vulnerability affects version 8.0.0 and presumably other 8.x versions prior to 8.2.2, though only 8.0.0 is explicitly stated as affected. No official patch or remediation level is currently documented.

An attacker with authenticated non-admin access can escalate privileges to admin by modifying restricted User fields such as roles and groups. This compromises access controls and potentially the entire system's security posture by granting unauthorized administrative capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious privilege changes. Avoid relying solely on USER_RESTRICTED_FIELDS controls for sensitive field protection.