Critical · published December 2, 2025
🚨 A crafty Power User can manipulate the userLevel parameter to promote any account to Administrator — it's like giving an employee the keys to the executive suite without a background check! 🔥 This vulnerability is akin to a hotel that forgets to check IDs at check-in, allowing just about anyone to wander in and claim a VIP suite. By simply changing a few details, a Power User can elevate others (or themselves) to higher privileges without proper authorization. An attacker can easily escalate privileges, granting Administrator access to lower-privileged accounts, and even change their passwords. This means they could take complete control over sensitive data and operations, potentially leading to a catastrophic breach of security and trust.
This vulnerability is akin to a hotel that forgets to check IDs at check-in, allowing just about anyone to wander in and claim a VIP suite. By simply changing a few details, a Power User can elevate others (or themselves) to higher privileges without proper authorization. The userLevel parameter in Terminalfour versions 8 through 8.4.1.1 lacks proper server-side authorization checks, allowing Power Users to manipulate account roles and passwords for existing users or even new accounts without safeguards.
An attacker can easily escalate privileges, granting Administrator access to lower-privileged accounts, and even change their passwords. This means they could take complete control over sensitive data and operations, potentially leading to a catastrophic breach of security and trust. Immediately patch to version 8.4.1.2 or later to fix this authorization oversight. Conduct an audit of all user accounts and permissions to ensure no unauthorized changes have been made. Strengthen server-side checks to prevent this kind of manipulation in the future. You've got this! With the right steps, you can lock this door tight and keep your system secure! 🛡️