CVE-2024-0795 — Create user API role not enforced
If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an…
Published: 2024-03-02 · CVSS: 7.2 · CVSS 3.0
If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an `admin` role and then be able to use this new account to have elevated privileges on the instance
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7