Create user API role not enforced

CVE-2024-0795

What is CVE-2024-0795?

The vulnerability within Mintplex Labs' product allows an attacker with access to an instance possessing admin or manager roles to bypass backend authentication measures. This incidental flaw permits the attacker to create a new user account with admin privileges, subsequently enabling unauthorized access and control over the instance. Such a security oversight poses a significant risk, as it facilitates potential exploitation of the system by malicious actors who can significantly impact data integrity and confidentiality.

References