High · published November 20, 2025
⚡ Users in the user_manage_team role can become empowered superusers with a few clicks! This privilege escalation vulnerability in SOPlanning lets them assign admin rights to anyone—yes, even themselves! 🔥 Think of it as a party where the guest with a simple invite suddenly gets the power to give out VIP wristbands. One moment, they’re just another attendee, and the next, they can access the secret backroom where all the good snacks are stored! An attacker, already authenticated as a user with a basic role, can climb the ranks to full admin privileges. This means they could alter settings, access sensitive data, or even lock out legitimate users from important functions. The potential for chaos is mind-blowingly simple!
Think of it as a party where the guest with a simple invite suddenly gets the power to give out VIP wristbands. One moment, they’re just another attendee, and the next, they can access the secret backroom where all the good snacks are stored! In SOPlanning, users with the 'user_manage_team' role can modify user permissions without proper checks. This allows them to grant themselves or others administrative privileges, leading to a significant privilege escalation issue.
An attacker, already authenticated as a user with a basic role, can climb the ranks to full admin privileges. This means they could alter settings, access sensitive data, or even lock out legitimate users from important functions. The potential for chaos is mind-blowingly simple! To protect your system, immediately upgrade to version 1.55 or higher. Audit user roles and permissions to ensure only trusted individuals have elevated privileges. Regularly review and update user access policies to prevent future exploits. You've got this! With these steps, you're well on your way to keeping your SOPlanning system secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| soplanning/soplanning | < 1.55.00 | 1.55.00 |