| Título | ChangeWeDer crm — CRM Customer Management System 0.0.1-SNAPSHOT CWE-862: Missing Authorization |
|---|
| Descripción | Missing Authorization Allows Privilege Escalation
1. Vendor
ChangeWeDer
2. Product
crm — CRM Customer Management System
3. Affected Version
0.0.1-SNAPSHOT
The affected code is present in the current master branch. The project does not appear to provide a formal release version; the Maven project version is 0.0.1-SNAPSHOT.
4. Vulnerability Type
CWE-862: Missing Authorization
Impact:
Privilege Escalation
5. Vulnerability Title
Missing Authorization in ChangeWeDer crm Allows Privilege Escalation to Administrator
6. Affected Component
top.upstudy.crm.controller.UserController
Primary affected endpoint:
/user/save
Additional affected areas identified during testing include:
/role
/customer
These endpoints contain insufficient or missing authorization checks.
7. Vulnerability Description
The ChangeWeDer crm application contains a missing authorization vulnerability that allows an authenticated low-privileged user to perform administrative user-management operations without the required authorization.
Multiple controller endpoints do not enforce the expected permission annotations or equivalent authorization checks. In particular, the /user/save endpoint can be accessed by a normal authenticated user and can be used to create or modify users and assign permissions.
As a result, a normal user can manipulate authorization-related data and obtain administrative functionality, resulting in vertical privilege escalation from a low-privileged account to an administrator-level account.
8. Root Cause
The root cause is missing authorization enforcement on sensitive user and role management endpoints.
The vulnerable flow can be summarized as:
Authenticated normal user
→ access /user/save
→ manipulate user permission/role information
→ authorization data is modified without verifying administrative privileges
→ attacker obtains administrative functionality
The endpoint lacks an effective authorization check restricting the operation to users with the appropriate administrative permission.
9. Attack Preconditions
The attacker must possess a valid low-privileged account.
No administrator account or administrative permission is required to initiate the attack.
10. Attack Vector
Remote.
The vulnerability can be triggered through HTTP requests to the affected application endpoints after authenticating as a normal user.
11. Proof of Concept
The vulnerability was reproduced locally using the following sequence:
Create a normal user account named test.
Authenticate to the application using the test account.
Observe that the normal user does not have access to administrative functionality.
Access the vulnerable user-management endpoint /user/save.
Modify the user's permission information through the vulnerable functionality.
Return to /user/index and observe that the test account has been assigned administrative functionality.
The previously unavailable functional modules become accessible to the test account.
This demonstrates successful vertical privilege escalation from a normal user to a privileged administrator-level user.
The original reproduction details are publicly documented in GitHub Issue #3.
12. Security Impact
A successful attacker can escalate privileges from a normal authenticated user to an administrator-level account.
This may allow the attacker to access administrative functionality, manage users and permissions, access protected CRM functionality, and perform operations that should be restricted to privileged administrators.
The vulnerability therefore breaks the application's authorization boundary between ordinary users and administrative users.
13. Additional Affected Endpoints
During the audit, multiple interfaces were identified without appropriate authorization checks.
In addition to /user/save, the /role and /customer controller areas contain authorization-control weaknesses.
The /user/save endpoint is the primary vulnerability because its exploitation was directly verified to result in privilege escalation.
14. Suggested Remediation
Sensitive user, role, and permission management operations should require explicit server-side authorization checks.
Recommended remediation:
Require an appropriate administrative permission before processing /user/save.
Apply authorization checks to all user-management endpoints.
Apply authorization checks to all role-management endpoints.
Apply authorization checks to sensitive customer-management endpoints.
Do not rely on front-end visibility or hidden menu items as an authorization mechanism.
Perform authorization checks on the server before modifying roles, permissions, or other security-sensitive data.
Add authorization tests covering low-privileged users attempting to invoke administrative endpoints.
15. References
GitHub Issue #3:
https://github.com/ChangeWeDer/crm/issues/3
GitHub Repository:
https://github.com/ChangeWeDer/crm
16. Disclosure Status
The vulnerability was publicly reported to the project maintainer through GitHub Issue #3 on August 20, 2026.
No fix was available at the time of reporting. |
|---|
| Fuente | ⚠️ https://github.com/ChangeWeDer/crm/issues/3 |
|---|
| Usuario | mjh_123 (UID 92618) |
|---|
| Sumisión | 2026-08-20 11:29 (hace 27 días) |
|---|
| Moderación | 2026-09-16 10:51 (27 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 405553 [ChangeWeDer crm hasta c07bd4c97141521af6475034bc58523beed51bbd top.upstudy.crm.controller.UserController UserController.java index escalada de privilegios] |
|---|
| Puntos | 20 |
|---|