An improper authorization vulnerability in Connect-CMS allows authenticated users to modify arbitrary user profiles, posing a significant risk to data integrity.

The vulnerability resides in the My Page profile update feature: due to improper authorization (CWE-285) and authorization bypass through user-controlled keys (CWE-639), an authenticated user can manipulate profile data belonging to other users.

This vulnerability carries a CVSS score of 8.1, reflecting a high impact on data integrity and confidentiality. Successful exploitation allows unauthorized modification of user records, which could lead to account takeover, privilege escalation, or the corruption of sensitive user information within the content management system.

Immediate Action: Update the Connect-CMS installation to version 1.41.1 or 2.41.1 to implement the necessary authorization checks.

Proactive Monitoring: Review audit logs for unusual profile update activity or mass modifications originating from standard user accounts.

Compensating Controls: Implement strict Web Application Firewall rules to monitor and filter requests targeting the profile update endpoint, though patching remains the only reliable mitigation.

Public Exploit Available: Unknown

The ability for a standard user to modify the profiles of other users represents a significant security failure in access control. Administrators must prioritize updating to the patched versions, 1.41.1 or 2.41.1, immediately to prevent unauthorized data manipulation. Failure to remediate this issue could result in widespread account compromise across the application.