Threats tagged 'ghsa-3c4r-whrm-5953'

DataCap versions through 2025.1.1 have a missing authorization vulnerability that allows any authenticated user, including self-registered accounts, to escalate privileges. By sending PUT requests to the /api/v1/user/allocationRole endpoint, attackers can assign themselves the administrator role and gain full control of the instance.