An authenticated missing authorization vulnerability in DataEase allows low-privileged users to perform unauthorized actions and access sensitive data.

This is a missing authorization vulnerability (CWE-862) occurring within the application, where an authenticated user with low privileges can perform actions or access data restricted to higher-privileged accounts.

The CVSS score of 8.7 reflects the high impact of this flaw, which enables privilege escalation and unauthorized data manipulation. This could lead to a compromise of internal systems, loss of data integrity, and potential disruption of business operations by malicious internal actors or compromised accounts.

Immediate Action: Upgrade to DataEase version 2.10.24 or later to resolve the authorization logic flaw.

Proactive Monitoring: Review audit logs for suspicious administrative actions performed by low-privileged user accounts.

Compensating Controls: Enforce the principle of least privilege by auditing user roles within the DataEase application to limit the potential blast radius of such an escalation.

Public Exploit Available: false

Privilege escalation vulnerabilities represent a significant threat to internal security. IT administrators must apply the vendor-provided security update to version 2.10.24 to ensure that authorization checks are correctly enforced across all user levels.