An authenticated privilege escalation vulnerability in M/Monit 3.7.4 allows standard users to gain administrative access, posing a severe risk to system integrity and control.

This vulnerability is an authorization flaw (CWE-863) located in the /api/1/admin/users/update endpoint. By sending a crafted POST request with the admin parameter set to 1, any authenticated user can elevate their account privileges to that of an administrator.

Successful exploitation of this vulnerability grants an attacker full administrative control over the M/Monit instance. This leads to complete compromise of the monitoring infrastructure, potential unauthorized access to managed systems, and the ability to modify critical configurations or intercept sensitive operational data. The CVSS score of 8.8 reflects the high severity of this unauthorized privilege escalation.

Immediate Action: Upgrade to a version of M/Monit where this vulnerability is resolved, as defined in the official vendor security advisory.

Proactive Monitoring: Review web access logs for unusual POST requests directed at the /api/1/admin/users/update endpoint, particularly those originating from non-administrative user accounts.

Compensating Controls: Implement strict network access controls to restrict access to the M/Monit management interface to authorized personnel only, and utilize a Web Application Firewall (WAF) to inspect and block requests containing unauthorized admin parameter modifications.

Public Exploit Available: Yes, a published proof-of-concept exploit exists via Exploit-DB (EDB-ID: 49080).

Given the availability of a functional proof-of-concept exploit and the high severity of the privilege escalation, organizations using M/Monit 3.7.4 must prioritize patching. Failure to remediate this issue allows any authenticated user to bypass security controls and obtain full administrative rights, creating an unacceptable risk to the entire managed environment.