Executive brief
Total.js CMS is a content management system used to build and manage web applications. A low-privileged authenticated user can bypass authorization checks on API endpoints to access and modify resources they do not own, enabling both horizontal (accessing other users' data) and vertical (escalating to higher privilege levels) privilege escalation attacks.
Technical details
The vulnerability is an authorization bypass (CWE-862) in Total.js CMS version 12.0.0. The product implements privilege checks only in the web frontend routes but fails to enforce the same controls on API endpoints. An authenticated attacker with limited privileges can directly call API methods to access and manipulate resources owned by other users or with higher privileges. The attack requires valid authentication credentials but no additional user interaction. An attacker can achieve both vertical and horizontal privilege escalation, leading to unauthorized data access and modification.
Affected products
- Total.js CMS 12.0.0
Timeline
- 2019-09-05: disclosed: Vulnerability disclosed via NVD and Full Disclosure mailing list
- 2022-05-24: advisory: GitHub Advisory GHSA-q3x9-28f7-w8rc published