Privilege Escalation in Masquerade Module for Backdrop CMS

CVE-2025-27822

What is CVE-2025-27822?

A flaw in the Masquerade module for Backdrop CMS allows unauthorized users to temporarily impersonate other users, including administrative accounts. This vulnerability arises from the module's insufficient enforcement of the 'Masquerade as admin' permission, potentially exposing sensitive administrative functions to unauthorized personnel. While access is contingent upon the attacker possessing the 'Masquerade as user' permission, the risk of misuse remains significant.

References