Shllokkk

An authorization bypass exists where an endpoint honors a caller-supplied flag that disables permission enforcement. Authenticated attackers can use this flag to skip permission checks and read party records that exceed their assigned role permissions.

Certain endpoints fail to enforce proper authorization checks. This allows authenticated attackers to send requests to these endpoints to modify documents and data beyond the permissions granted to their assigned role.

An issue exists in a record-creation endpoint that accepts the record type from the request and inserts the record while permission checks are disabled. This allows any authenticated user, regardless of their operational role, to specify a privileged record type to create privileged accounts and gain full control of the site.