CVE-2024-50671

Summary

CVE-2024-50671 is a vulnerability affecting Adapt Learning Adapt Authoring Tool versions below 0.11.3. This issue stems from incorrect access control, allowing authenticated users with the role of User to access email addresses of other users via the "Get users" feature. The cause of the vulnerability lies in a flawed permission verification logic, which incorrectly grants access to endpoints restricted to Super Admin roles due to the use of a wildcard character in permitted URLs. Consequently, attackers can obtain the email addresses of all users within the system.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.