Threats tagged 'ghsa-wm3g-q849-7hj8'

Storyden versions up to 1.26.16 have a privilege escalation vulnerability that allows users with the MANAGE_ROLES permission to grant themselves the ADMINISTRATOR permission without already being administrators. This can be exploited by calling AccountAddRole on another account controlled by the attacker or by creating and updating roles to have administrator privileges, enabling full control over the instance.