A critical authorization bypass vulnerability in Crafty Controller allows authenticated attackers to perform unauthorized user modifications, posing a significant risk to system integrity.

This is an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639) within the Users API component. It allows an authenticated attacker with high privileges to manipulate API requests to modify user accounts due to insufficient server-side authorization checks.

The vulnerability carries a CVSS score of 9.0, reflecting its potential for total impact on system confidentiality and integrity. Successful exploitation could allow an attacker to escalate privileges, hijack administrative accounts, or modify critical user data, leading to a complete compromise of the application’s user management security model.

Immediate Action: Upgrade the Crafty Controller instance to version 4.10.3 immediately to apply the necessary authorization logic fixes.

Proactive Monitoring: Review API access logs for anomalous patterns, specifically looking for unauthorized POST or PUT requests targeting user management endpoints.

Compensating Controls: Ensure the instance is not exposed to the public internet and restrict access to the API via network-level controls (e.g., VPN or IP whitelisting) to minimize the attack surface.

Public Exploit Available: No (exploit_available: false)

The risk associated with this vulnerability is high due to the potential for unauthorized administrative actions. Administrators should prioritize upgrading to version 4.10.3 as soon as possible to remediate the underlying authorization bypass.