Missing Authorization Vulnerability in Woffice Core Affects Functionality Not Properly Constrained by ACLs

CVE-2024-37470

Summary

A missing authorization vulnerability exists in the WofficeIO Woffice Core, which may allow unauthorized users to access functionalities that are supposed to be restricted by Access Control Lists (ACLs). This vulnerability impacts all versions of Woffice Core up to and including 5.4.8, potentially enabling malicious actors to exploit the issue and gain unauthorized access to sensitive functionality. Users and administrators are advised to review their security settings and apply necessary updates to mitigate potential risks associated with this flaw.

References