An authentication bypass vulnerability in Cicool builder 3.4.4 permits unauthenticated attackers to reset the administrator password and gain full control of the application.

The application fails to properly validate requests to the password reset endpoint, allowing an unauthenticated attacker to trigger a password reset for the administrative account.

The ability to reset the administrator password grants an attacker complete administrative control over the Cicool builder instance. With a CVSS score of 9.8, this vulnerability poses a critical risk to business operations, potentially resulting in unauthorized data access, system manipulation, and total takeover of the application environment.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /administrator/auth/reset_password endpoint using a Web Application Firewall (WAF) or server-level access controls.

Proactive Monitoring: Review web access logs for frequent or unauthorized requests to the password reset endpoint and monitor for unexpected changes to administrative user accounts.

Compensating Controls: If possible, implement IP-based access restrictions to the administrative interface to prevent external attackers from reaching the vulnerable endpoint.

Public Exploit Available: Unknown (CISA SSVC assessment notes a PoC exists, but no weaponized exploit is confirmed).

This is a critical vulnerability that effectively grants administrative access to an attacker. Administrators must treat this as a high-priority incident and apply restrictive network controls immediately until a vendor-supplied patch is released.