EUVD-2026-24199
GHSA-8mj7-3xh5-xpj7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
5DescriptionCVE.org
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
AnalysisAI
Crafty Controller Users API allows authenticated administrators with high privileges to modify other user accounts due to improper API permission validation. Despite requiring PR:H (high privileges) and authentication, the vulnerability achieves CVSS 9.0 due to scope change, enabling privilege escalation and potential system-wide compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated access with high-privilege administrative credentials (PR:H from CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-to-high despite the 9.0 CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with compromised high-privilege administrative credentials authenticates to the Crafty Controller web interface and directly crafts API requests to the Users API endpoint, manipulating user ID parameters to modify accounts outside their intended scope. By exploiting the missing authorization validation (CWE-639), the attacker escalates their privileges, modifies other administrator accounts, injects backdoor accounts, or alters user permissions to gain persistent access across the Minecraft server management infrastructure. |
| Remediation | Review the GitLab work item at https://gitlab.com/crafty-controller/crafty-4/-/work_items/705 for vendor-provided fixes and affected version details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Crafty Controller deployments and document current version numbers; restrict API access to Crafty Controller Users API to essential administrators only and enable detailed logging of all user account modification attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today