Threats tagged 'ghsa-25g3-pjxj-3892'

Map-OS versions 5.0.0 up to but not including 5.2.2 have a privilege escalation vulnerability in the REST users API. This flaw allows non-administrator users with the cUsuario permission to bypass permission delegation and super-administrator protections. Exploitation involves sending POST, PUT, or DELETE requests to the /api/v1/usuarios endpoint to assign the Administrador group, reset the super administrator password, or delete users with higher privileges.