Description
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missing a separate check that the enrollment editor has access (or belongs to) the organization that they are adding a user to.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Palantir com.palantir.controlpanel:control-panel
1.1395.1unaffected1.1384.1unaffected1.1401.0 to < *unaffected* to < 1.1401.0affected1.1346.1unaffected1.1352.1unaffected1.1352.5unaffected