In2Code

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration. This flaw allows for self-service privilege escalation into arbitrary frontend groups.

The extension does not require a dedicated admin confirmation token when processing admin-approval requests. This allows a regular user to self-approve a pending account by using a user confirmation hash, which can be obtained by any visitor through the public resend-confirmation action.

The user detail view of the extension does not verify if the requested user record matches the configured or logged-in target. This allows visitors with access to the Detail or List plugin to retrieve profile data of other frontend users, such as name, email, date of birth, and address, by providing an arbitrary `user ID`.

The invitation controller fails to stop processing after redirecting when it encounters invalid input, such as a missing hash or users that are non-existent, disabled, or deleted. This allows an unauthenticated attacker to re-enable and set a new password for any existing frontend user account.