A high-severity privilege management vulnerability in Cleo Harmony allows unauthenticated remote attackers to manipulate session tokens, potentially leading to unauthorized access.

This flaw exists within the JWT Refresh Token Handler at the /api/connections endpoint. An unauthenticated attacker can exploit this via the Bearer parameter to perform improper privilege management, effectively bypassing standard access controls.

The vulnerability carries a CVSS score of 8.3, reflecting the significant risk posed by unauthenticated remote access to sensitive connection management functions. Successful exploitation could lead to unauthorized administrative control over the application, resulting in data exposure, integrity loss, or the potential for lateral movement within the network environment.

Immediate Action: Upgrade Cleo Harmony immediately to version 5.8.1.11 or later to resolve the underlying privilege management flaw.

Proactive Monitoring: Review web server and application access logs specifically for unusual or malformed requests targeting the /api/connections endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate JWT-related headers and block suspicious manipulation of the Bearer token parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked vulnerability database references.

Given the ease of remote exploitation and the existence of a public proof-of-concept, organizations must prioritize the application of the 5.8.1.11 update. Failure to remediate this vulnerability leaves the application susceptible to session hijacking and unauthorized privilege escalation. Immediate patching is the only effective way to eliminate this risk.