Description
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
devlive-community DataCap
Default version status: unaffected
0 to ≤ 2025.1.1affected
References
- https://github.com/devlive-community/metaforge/issues/969 ↗
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/user/UserController.java#L97-L108 ↗
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-service/src/main/java/io/edurt/datacap/service/service/impl/UserServiceImpl.java#L104-L137 ↗
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/admin/RoleController.java#L34-L52 ↗
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-security/src/main/java/io/edurt/datacap/security/SecurityConfigure.java#L63-L78 ↗
- https://hackmd.io/@hieuPenguinnn/metaforge-datacap-allocation-role-missing-authz-privilege-escalation ↗
- https://github.com/devlive-community/metaforge ↗
- https://www.vulncheck.com/advisories/datacap-through-2025.1.1-privilege-escalation-via-allocationrole-missing-authorization ↗