EUVD-2026-17771
GHSA-vwp7-r9vq-p5wq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Privilege escalation in z-9527 admin 1.0/2.0 allows authenticated users to manipulate the isAdmin parameter in the User Update Endpoint (/server/routes/user.js) to gain administrative privileges through dynamically-determined object attributes. The vulnerability requires network access and valid credentials (PR:L per CVSS vector) but no user interaction. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, leaving all versions in the 1.x and 2.x branches unpatched.
Technical ContextAI
The vulnerability stems from CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), a class of flaw where user-supplied input directly influences object property assignment without proper validation. In this case, the /server/routes/user.js endpoint accepts an isAdmin parameter that is processed without adequate authorization checks or type validation, allowing an authenticated user to set this attribute to 1 and grant themselves admin privileges. The affected product is z-9527 admin, a Node.js-based application (per CPE cpe:2.3:a:z-9527:admin:*:*:*:*:*:*:*:*), and the flaw exists in both versions 1.0 and 2.0. This is a classic object injection vulnerability pattern common in loosely-typed JavaScript backends that assign request parameters directly to user objects.
RemediationAI
No vendor-released patch identified at time of analysis, as the vendor did not respond to early disclosure attempts. Immediate mitigation requires implementing proper authorization validation in the User Update Endpoint at /server/routes/user.js to ensure only admin users can modify the isAdmin attribute; this should include server-side role checks before processing any privilege-modification requests. Alternatively, restrict User Update Endpoint access to administrators only via authentication middleware. If upgrade is possible, verify with the vendor whether versions beyond 2.0 contain fixes (though no response history suggests this is unlikely). Organizations unable to patch should consider removing or isolating the application from multi-user environments where privilege escalation poses significant risk. The publicly available exploit at https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-11 should be reviewed to understand the exact attack method and inform custom patches or compensating controls.
A vulnerability classified as critical was found in ContiNew Admin 3.2.0. Rated medium severity (CVSS 5.1), this vulnera
Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack t
Path traversal in z-9527 admin's file upload function allows authenticated remote attackers to manipulate the fileType p
Stored cross-site scripting (XSS) in z-9527 admin 1.0 and 2.0 allows authenticated remote attackers to inject malicious
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary num
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today