Bender
Monthly
Authenticated low-privileged users of the Bender Customer & Partner platform can retrieve the administrator-only role list because an affected endpoint performs no server-side authorization check (CWE-862). The flaw is reachable over the network with no user interaction, but an attacker must already hold a valid low-tier account, and the exposed data is explicitly limited to a non-sensitive role listing, so the impact is confined to a low-level confidentiality loss. No public exploit code has been identified at time of analysis, and the overall issue is a genuinely low-priority one: it is a broken access control on an already-authenticated endpoint rather than a true authentication bypass, despite the record's 'Authentication Bypass' tag.
Authenticated low-privileged users of the Bender Customer & Partner platform can retrieve the administrator-only role list because an affected endpoint performs no server-side authorization check (CWE-862). The flaw is reachable over the network with no user interaction, but an attacker must already hold a valid low-tier account, and the exposed data is explicitly limited to a non-sensitive role listing, so the impact is confined to a low-level confidentiality loss. No public exploit code has been identified at time of analysis, and the overall issue is a genuinely low-priority one: it is a broken access control on an already-authenticated endpoint rather than a true authentication bypass, despite the record's 'Authentication Bypass' tag.