Description
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ikus-soft | rdiffweb | < 2.10.6 | 2.10.6 |