An unauthenticated authentication bypass in TarsWeb allows remote attackers to gain full administrative access to the platform, posing a critical risk to system integrity.

The application incorrectly trusts client-controlled X-Forwarded-For headers to determine the request origin and fails to validate credentials when specific loopback conditions are met. An unauthenticated attacker can forge these headers and supply a target user ID to perform actions with the privileges of any account, including administrators.

Successful exploitation grants an attacker full control over the TarsWeb console. This includes the ability to modify user roles, alter service configurations, deploy malicious packages, and gain unauthorized access to underlying infrastructure management. Given the CVSS score of 9.8, this vulnerability represents a critical threat that could lead to complete system compromise and data exfiltration.

Immediate Action: Update TarsCloud TarsWeb to version 3.0.16 or later, which corrects the authentication logic to prevent unauthorized account impersonation.

Proactive Monitoring: Review web server and application access logs for requests originating from unexpected IP addresses that contain X-Forwarded-For headers pointing to loopback addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and strip untrusted X-Forwarded-For headers, and restrict network access to the TarsWeb console to known, trusted management segments.

Public Exploit Available: Unknown

This vulnerability presents a severe risk to the confidentiality and integrity of your TarsCloud environment. Due to the ease of exploitation and the potential for full administrative takeover, organizations must prioritize upgrading to version 3.0.16 immediately. If an immediate update is not feasible, implement strict network-level access controls to ensure the console is not exposed to untrusted networks.