An authorization bypass in RansomLook allows authenticated users to modify critical system configurations and potentially disrupt application services.

The application fails to enforce adequate authorization checks on the /admin/config endpoint. While the endpoint requires an authenticated session, it does not distinguish between administrative and low-privileged users, allowing unauthorized configuration changes.

The ability to modify configuration files, including LDAP, SMTP, and authentication settings, poses a severe risk to system integrity and availability. With a CVSS score of 9.4, this vulnerability allows an attacker to redirect traffic, compromise authentication flows, or render the application unusable.

Immediate Action: Upgrade to the latest version of RansomLook, which removes the vulnerable configuration-editing interface entirely.

Proactive Monitoring: Audit application logs for unauthorized access attempts to the /admin/config endpoint and monitor configuration files for unexpected changes.

Compensating Controls: Restrict access to the administrative network segment and implement strict Role Based Access Control (RBAC) to minimize the impact of a compromised low-privileged account.

Public Exploit Available: No

Given the critical severity of this authorization failure, immediate remediation is required to prevent unauthorized control over the application environment. Organizations should prioritize updating the software and reviewing all current user permissions to ensure that access to administrative functions is strictly limited.