A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, enabling them to access and modify sensitive information.
The web application does not properly verify user permissions on the server side, relying on parameters passed by the client. A logged-in user with standard privileges can modify specific parameters in an HTTP request (e.g., in the request body, headers, or URL) to make the application treat them as a super administrator. This is a typical case of CWE-1220 error (Insufficient Granularity of Access Control), where access control is not sufficiently precise and rigorous.
An attacker with a basic user account can obtain super administrator privileges, allowing them to access sensitive information and modify it without authorization.
Patches available from the vendor should be applied according to references. Additionally, it is recommended to implement permission verification exclusively on the server side, independent of parameters supplied by the user.
Versions indicated in vendor references
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NAugmentt
APPAugmentt< 2025-10-02