An improper authorization vulnerability in the anjoy8 Blog.Core API allows authenticated attackers to access sensitive administrative data, posing a significant risk to user account security.

The vulnerability exists within the getinfobytoken API interface (specifically in UserController.cs). It stems from incorrect authorization (CWE-863), which allows any authenticated user to retrieve sensitive administrative information that should be restricted to higher privilege levels.

This vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation could lead to unauthorized access to administrative account details, potentially facilitating further attacks such as account takeover, unauthorized configuration changes, or full system compromise. The exposure of sensitive data may also result in regulatory non-compliance and loss of trust in the integrity of the affected platform.

Immediate Action: Monitor for official security updates from the project maintainers and apply patches to the Blog.Core software as soon as they become available.

Proactive Monitoring: Review API access logs for unusual patterns or spikes in requests directed at the UserController endpoint, particularly those originating from non-administrative user accounts.

Compensating Controls: Implement stricter API gateway authentication and authorization policies to ensure that only authorized administrative roles can access the sensitive fields exposed by the getinfobytoken interface.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the GitHub gist referenced in the CVE record.

Given the availability of a published proof-of-concept and the high severity of the authorization flaw, organizations utilizing anjoy8 Blog.Core should prioritize the mitigation of this vulnerability. Until a formal patch is applied, administrators should restrict access to the affected API endpoints through network-level controls or web application firewall rules to prevent unauthorized data exposure.