Eta Register
Monthly
Missing authorization in eta-register versions 2.0.8 and later but before 2.0.9 lets a locally present, low-privileged authenticated user escalate privileges within the application, with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is a CWE-862 missing authorization check reported by TR-CERT; the specific feature, endpoint or request that skips the check is not described in the available sources. No public exploit code is identified in the supplied data and the issue is not in CISA KEV; updating to 2.0.9 is the stated resolution, and priority is rated for handling this week.
Missing authorization in eta-register versions 2.0.8 and later but before 2.0.9 lets a locally present, low-privileged authenticated user escalate privileges within the application, with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is a CWE-862 missing authorization check reported by TR-CERT; the specific feature, endpoint or request that skips the check is not described in the available sources. No public exploit code is identified in the supplied data and the issue is not in CISA KEV; updating to 2.0.9 is the stated resolution, and priority is rated for handling this week.