N A EUVD-2026-23902

Authenticated access to Doorman with any valid user role (even the lowest-privilege 'viewer' or 'guest' role). The vulnerability is exploitable against default configurations where self-service user profile updates are enabled via the /platform/user/{username} endpoint. Specifically requires: (1) Doorman versions 0.1.0 or 1.0.2 deployed with the user management API enabled, (2) attacker possesses valid login credentials (username/password or API token) for any account, regardless of assigned role, (3) the platform accepts PUT or PATCH HTTP methods to the /platform/user/ path. Exploitation is LIMITED by: the need for initial authentication (PR:L in CVSS) - purely external attackers must first compromise or register an account; the Changed Scope suggests cross-tenant impact is only possible if Doorman is deployed in multi-tenant mode rather than single-organization installations. No special network position, user interaction, or non-default configuration is required once authentication is achieved.

Real-world risk is HIGH despite the PR:L (low privilege) requirement. CVSS 9.9 accurately reflects severity: network-accessible (AV:N), trivial to exploit once authenticated (AC:L), and delivers high confidentiality/integrity impact with Changed scope. SSVC decision framework rates this 'partial' technical impact with POC availability but non-automatable - meaning attackers need valid credentials first, but privilege escalation is then straightforward via API manipulation. The lack of CISA KEV listing suggests no confirmed mass exploitation, but the POC existence (per SSVC and researcher blog post) lowers the barrier significantly. The Changed scope is critical: escalated users likely gain cross-tenant access or pipeline control in CI/CD environments where Doorman gates API resources. Primary risk drivers are: (1) API gateways often protect high-value backend systems, (2) many organizations grant 'basic user' access broadly for legitimate integration, (3) POC code makes this a copy-paste attack for any malicious insider or compromised low-privilege account. Compared to typical privilege escalation flaws, the network vector and scope change elevate this from 'annoying' to 'infrastructure compromise.'

Attacker obtains or creates a low-privilege 'viewer' account in Doorman (e.g., via open registration or compromised credentials). Using the POC code from the researcher blog, they send a PUT request to /platform/user/{their_username} with JSON payload including '"role": "manager"'. The platform applies the role change without permission validation. Attacker now accesses management APIs, views sensitive routing configurations, or modifies API policies affecting other tenants. In multi-tenant SaaS environments, this grants cross-customer data access.