A critical privilege escalation vulnerability in the h44z wg-portal management interface allows any authenticated user to gain full administrative access to the VPN configuration.

The application fails to properly restrict the IsAdmin boolean field when a user updates their own profile. An authenticated attacker can submit a crafted JSON payload during a PUT request to the profile endpoint to promote their account to administrator status, bypassing existing authorization controls.

Successful exploitation grants an attacker full administrative control over the WireGuard VPN management portal. This level of access allows the attacker to manipulate VPN configurations, intercept or redirect network traffic, manage user credentials, and potentially compromise the entire internal network infrastructure. With a CVSS score of 8.8, this flaw represents a significant risk to organizational confidentiality, integrity, and availability.

Immediate Action: Update the h44z wg-portal application to version 2.1.3 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review audit logs for suspicious PUT requests to user profile endpoints, specifically monitoring for unusual changes to administrative flags.

Compensating Controls: Restrict access to the wg-portal management interface to known administrative IP addresses via firewall rules or VPN-based access control until the update can be applied.

Public Exploit Available: Unknown

Given the high severity of this privilege escalation vulnerability, immediate remediation is required to prevent unauthorized administrative control of the VPN infrastructure. Organizations should prioritize updating to version 2.1.3 or later and audit existing user accounts for any unauthorized changes to administrative privileges that may have occurred prior to patching.