APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. Prior to version 2.0.1, the edit_user endpoint (POST /api/auth/edituser/<pk>) allows Any user who can reach that endpoint and submit crafted permission to escalate their own account (or any other account) to superuser by including "is_superuser": true in the request body. The root cause is that CustomUserSerializer explicitly includes is_superuser in its fields list but omits it from read_only_fields, making it a writable field. The edit_user view performs no additional validation to prevent non-superusers from modifying this field. Once is_superuser is set to true, gaining unrestricted access to all application functionality without requiring re-authentication. This issue has been patched in version 2.0.1.
The POST /api/auth/edituser/<pk> endpoint is handled by the CustomUserSerializer class, which explicitly includes the is_superuser field in the serializer's field list, but does not mark it as read_only_field. As a result, this field is writable by any user who can call this endpoint. The edit_user view performs no additional verification to check whether the person sending the request has permissions to modify this field. It is sufficient to include "is_superuser": true in the request body to immediately gain administrator privileges without needing to re-authenticate.
The attacker gains unrestricted access to all APTRS application functions at the superuser level, which in practice means complete takeover of the penetration testing reporting system, including access to sensitive client data and security reports.
Update APTRS to version 2.0.1, where the issue has been resolved by properly marking the is_superuser field as read_only in the serializer. The patch is available in the GitHub repository under the 2.0.1 tag.
APTRS (Automated Penetration Testing Reporting System) in versions prior to 2.0.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XAptrs
APPAptrs< 2.0.1