An authorization vulnerability in ELOG allows authenticated users to manipulate other user accounts, posing a significant risk of unauthorized account access and privilege escalation.

This vulnerability is classified as CWE-862 (Missing Authorization) and occurs because the application fails to verify permissions when a user modifies profile information. An attacker with a valid account can change a target user's email address and initiate a password reset to hijack the account.

Successful exploitation results in full account takeover, which can lead to unauthorized data access, potential lateral movement within the application, and compromise of sensitive information. With a CVSS score of 8.8, this high-severity vulnerability represents a substantial threat to the integrity and confidentiality of the user directory and associated business processes.

Immediate Action: Review the provided vendor commit references and apply the necessary code changes or updates as they become available from the project maintainers.

Proactive Monitoring: Monitor user profile update logs for suspicious patterns, such as mass email address changes or unusual account modification activity originating from non-administrative sessions.

Compensating Controls: Implement strict access controls at the network level and ensure that administrative functions are segregated from standard user sessions where possible.

Public Exploit Available: Unknown

Given the high impact of potential account takeovers, organizations using ELOG should prioritize the implementation of the vendor-provided fixes. Administrators must verify their current deployment against the cited commit logs and apply security patches immediately upon release to prevent unauthorized account manipulation.