High · published December 9, 2025
⚡ Multiple access control flaws in adata Software GmbH Mitarbeiterportal can turn your trusted users into rogue admins! 🔥 Think of it like a restaurant where low-level staff can sneak into the kitchen and make menu changes or serve any dish they want without permission — chaos in a cooking space! This vulnerability allows remote authenticated users, even those with low privileges, to perform administrative tasks and manipulate data belonging to others. An attacker could easily modify or delete critical user information, leading to a major breach of trust and potential data loss!
Think of it like a restaurant where low-level staff can sneak into the kitchen and make menu changes or serve any dish they want without permission — chaos in a cooking space! The incorrect access controls enable unauthorized API calls that allow low-privileged users to access administrative functions and data manipulation, bypassing intended restrictions.
This vulnerability allows remote authenticated users, even those with low privileges, to perform administrative tasks and manipulate data belonging to others. An attacker could easily modify or delete critical user information, leading to a major breach of trust and potential data loss! Ensure you update Mitarbeiterportal to version 2.15.2.1 immediately to patch these vulnerabilities. Additionally, review your API access policies to prevent unauthorized function calls in the future. You’ve got this! By taking these steps, you'll help keep your system secure and your users safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| adata/mitarbeiter_portal | < 2.16.1 | 2.16.1 |