EUVD-2026-24199
GHSA-8mj7-3xh5-xpj7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
AnalysisAI
Crafty Controller Users API allows authenticated administrators with high privileges to modify other user accounts due to improper API permission validation. Despite requiring PR:H (high privileges) and authentication, the vulnerability achieves CVSS 9.0 due to scope change, enabling privilege escalation and potential system-wide compromise. GitLab reports this as an authentication bypass affecting Crafty Controller by Arcadia Technology, LLC. No CISA KEV listing or public exploit code identified at time of analysis, though the authentication bypass tag suggests deviation from intended access controls even for privileged users.
Technical ContextAI
Crafty Controller is a web-based Minecraft server management platform developed by Arcadia Technology, LLC. The vulnerability resides in the Users API component, specifically CWE-639 (Authorization Bypass Through User-Controlled Key), where API endpoints fail to properly validate whether an authenticated high-privilege user should have permission to modify specific user objects. Insecure Direct Object References (IDOR) occur when applications expose internal implementation objects (like user IDs or database keys) in API parameters without verifying the requester has rights to access or modify that specific resource. In this case, an authenticated administrator can manipulate user identifiers in API requests to modify accounts they shouldn't control, bypassing intended role-based access boundaries within the administrative tier.
RemediationAI
Review the GitLab work item at https://gitlab.com/crafty-controller/crafty-4/-/work_items/705 for vendor-provided fixes and affected version details. If a patched version is available, upgrade immediately following the project's release notes. As an interim mitigation, implement the following controls: Restrict administrative account access to trusted personnel only with multi-factor authentication enforced; monitor Users API endpoints for unusual modification patterns (audit logs showing admin accounts modifying other admin accounts or cross-boundary user changes); implement network segmentation to limit access to the Crafty Controller management interface to trusted networks only (not public internet); consider API gateway or reverse proxy rules that add additional authorization checks before requests reach the Users API component, validating that the authenticated user has explicit rights to modify the target user object. Note that network restrictions reduce attack surface but do not eliminate risk from authenticated insiders or compromised admin sessions.
More in Crafty Controller
View allStored cross-site scripting (XSS) vulnerability in Crafty Controller that allows authenticated attackers to inject malic
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticate
Path traversal in Crafty Controller game server management allows authenticated attackers to read/write files outside th
Remote code execution in Crafty Controller (crafty-4), a web-based management panel for Minecraft servers, arises from p
Remote code execution in Crafty Controller's Backup Configuration feature results from insufficient path traversal valid
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today