CVE-2024-0439 — User can manually send request at manager permission to modify system configurations
As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough …
Published: 2024-02-25 · CVSS: 7.1 · CVSS 3.0
As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings though through a standard HTTP request While this is not a critical vulnerability, it does indeed need to be patched to enforce the expected permission level.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7