Edoweb
Monthly
Authorization bypass in EdoWEB (all versions before 780-g7) by Netiket Information Technologies allows authenticated low-privileged users to access ACL-restricted functionality and data by manipulating user-controlled keys. The flaw is rooted in CWE-639 (Insecure Direct Object Reference), where the application trusts a client-supplied key without verifying the requesting user's authorization to the referenced object. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; exploitation is constrained by high attack complexity and a required authenticated session.
Authorization bypass in EdoWEB (all versions before 780-g7) by Netiket Information Technologies allows authenticated low-privileged users to access ACL-restricted functionality and data by manipulating user-controlled keys. The flaw is rooted in CWE-639 (Insecure Direct Object Reference), where the application trusts a client-supplied key without verifying the requesting user's authorization to the referenced object. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; exploitation is constrained by high attack complexity and a required authenticated session.