提交 #894906: Eleveo Quality Management 9.7.0 Mass Assignment

A Mass Assignment vulnerability exists in the /enc-fwk-data/api/v3/conversations/<ID>/events endpoint of Eleveo Quality Management 9.7.0, allowing authenticated users to spoof conversation tag ownership. The application accepts and processes client-supplied attributes without properly restricting which fields can be modified. By manipulating the createdBy field, an attacker can remove ownership entirely or assign the tag to another user. The backend relies on client-controlled data when creating or updating tags and does not enforce server-side validation of permitted fields, resulting in unauthorized modification of tag ownership.

Impact
• Impersonation may occur when attackers assign actions to other users, misleading audit trails and accountability.
• Integrity violation may occur when ownership of records is manipulated, affecting trust in system data.
• Audit trail manipulation may occur when logs and records reflect incorrect user attribution.
• Information disclosure may occur when attackers retrieve or infer valid user identifiers for exploitation.

PoC
Comprehensive reproduction steps, including supporting screenshots, are available via the shared private link. Public disclosure will occur on GitHub after the responsible disclosure period of approximately 90 days has elapsed.

Note
Contact with the vendor was initiated on April 5, and no response has been received as of the submission date. The provided PoC is accessible via a restricted link and is intended solely for review purposes by anyone possessing the link. I plan to reserve a CVE early, with public disclosure scheduled after 90 days from the initial contact date, at which point the advisory will be published on my GitHub repository. The information shared here is provided exclusively to the VulnDB team to ensure awareness and understanding of the vulnerability details.

• 来源: ⚠️ https://drive.google.com/file/d/1fVUqrUoO29zkq2Ib_TXFNavX9yDo-Vp6/view?usp=sharing
• 用户: omarelshopky (UID 85487)
• 提交: 2026-07-18 14時52分 (2 月前)
• 管理: 2026-09-03 20時45分 (2 months later)
• 状态: 已接受
• VulDB条目: 398558 [Eleveo Quality Management 9.7.0 Conversation events createdBy]
• 积分: 20