Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Doorman allows any authenticated user to escalate their privileges by changing their account role. This happens because the system doesn't properly check permissions when a user updates their own role, potentially granting them administrative access.
- Privileged access granted.
- Affects authenticated users.
- Allows role changes.
Attack Path
How an attacker could exploit the issue
An authenticated user can escalate their privileges by manipulating their own role within the Doorman application. This allows them to gain admin-like capabilities without needing direct administrator access, effectively turning a standard user account into a powerful one.
- Authenticated user needed.
- Target user account update.
- Bypass role permission check.
Live Threat
Current exploitation, exposure, and threat context
Attackers are unlikely to prioritize weaponizing this CVE because it requires an existing authenticated user session to exploit. This is an access control flaw within the application's internal user profile update mechanism, not an unauthenticated or network-facing vulnerability.
- Requires authenticated user.
- Not a network edge exploit.
- Relies on self-update logic.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Doorman to the latest version, as this vulnerability allows any authenticated user to escalate privileges. If immediate patching is not feasible, implement strict monitoring for unauthorized role changes on user accounts.
- Apply Doorman version 1.0.3 or later.
- Monitor user account role update API calls.
- Block requests altering user roles.
