Privilege Escalation Vulnerability in Gladys Assistant

CVE-2024-47210

What is CVE-2024-47210?

Gladys Assistant prior to version 4.45.1 has a vulnerability that allows users to escalate their privileges by manipulating the request body. Specifically, the parameter req.body.role in the updateMySelf function located in server/api/controllers/user.controller.js can be exploited, enabling a user to change their role unauthorizedly. This may lead to unauthorized access and actions within the application, thereby posing a significant risk to user data and operations.

References