Admin EUVD-2026-17771

This vulnerability presents moderate-to-high practical risk despite a CVSS score of 6.3. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network-accessible attack requiring low privilege (authenticated user) and low complexity, with limited scope and partial impacts on confidentiality, integrity, and availability. The E:P (Exploit Proofs-of-Concept) tag confirms public availability of working exploit code, significantly increasing real-world exploitability. However, the PR:L requirement means this is not an unauthenticated remote code execution-an attacker must already have valid user credentials. The absence of KEV status and lack of disclosed active exploitation in the wild suggest this may not be a priority 0 emergency, but organizations running z-9527 admin with multi-user access should treat this as high priority for internal access control scenarios (e.g., a compromised or malicious low-privilege user escalating to admin). The vendor's non-response to early disclosure indicates no patched version is forthcoming, making remediation dependent on application removal or architectural changes.

An authenticated user with low-privilege account access (e.g., a regular user account on z-9527 admin) submits a request to the User Update Endpoint (/server/routes/user.js) with the isAdmin parameter set to 1. Due to lack of authorization validation, the backend dynamically assigns this attribute to the user object without checking privileges, resulting in the user being granted admin rights. The attacker then uses their newly elevated privileges to access sensitive data, modify other users, or disrupt system availability. Publicly available exploit code (per GitHub reference) automates this process, lowering the barrier to exploitation for any authenticated attacker.