| Title | Cleo Harmony < 5.8.1.11 Privilege Escalation via Cross-Store Identity Lookup Confusion |
|---|
| Description | The Cleo Harmony authentication handler has a vulnerability where refresh tokens (JWTs) are issued with incorrect authorization metadata. The server mistakenly stamps refresh tokens with a `UNI_ADMIN` type tag while populating the `sub` claim with the user's local identifier.
This mismatch creates a cross-store identifier collision during token replay: the `UNI_ADMIN` tag directs the server to validate the token against the independent administrator user store rather than the standard user database. While authentication fails for most users due to the lack of a matching entry, the server erroneously grants full administrative access if the `sub` claim matches an existing administrator's username, effectively treating the two independent namespaces as interchangeable.
This vulnerability can be successfully weaponized by chaining it with the separately reported SAML XML Signature Wrapping (XSW) flaw (https://vuldb.com/submit/882467). By asserting the default username `administrator` via the XSW flaw, an attacker can force the issuance of a refresh token that resolves to the administrative account upon replay. This grants unrestricted access to the Cleo Administrative API and WebAdmin interface.
Technical Details:
1. Exploit the SAML XSW vulnerability (separately reported in ticket #14484067) by setting `User.Email = administrator`.
2. POST the wrapped SAMLResponse to the `/portal` endpoint to obtain the initial SAML SSO JWT.
3. Force the server to create a `UNI_ADMIN` refresh token. Ensure the `cleo.portal.sso_authentication` cookie is removed before sending the request:
POST /api/authentication/refresh HTTP/2
Host: cleo.example.com
Authorization: Bearer <SAML_jwt from Step 2>
Content-Length: 0
Response (200 OK), containing the `refresh_token` claims:
{
"sub": "administrator",
"AccessType": "UNI_ADMIN",
"iss": "http://www.cleo.com"
}
4. Replay the refresh token as a `Bearer` token against any administrative `/api/*` endpoint:
GET /api/connections HTTP/2
Host: cleo.example.com
Authorization: Bearer <UNI_ADMIN refresh_token from Step 3> |
|---|
| Source | ⚠️ https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111 |
|---|
| User | Anonymous User |
|---|
| Submission | 07/07/2026 23:24 (2 months ago) |
|---|
| Moderation | 09/01/2026 09:20 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 397558 [Cleo Harmony up to 5.8.1.10 JWT Refresh Token /api/connections Bearer privileges management] |
|---|
| Points | 20 |
|---|