PT-2026-81870 · Gazellepw · Gazellepw
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
GazellePW (GazellePosterWall) (affected versions not specified)
Description
Broken access control in the API user endpoint allows authenticated users without elevated privileges to enable or disable any user account. This is achieved by sending a request to the endpoint using a standard user-created API token with the
req parameter set to either disable or enable.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gazellepw