Executive brief
Orion-Ops is a server management and operations platform. An authenticated attacker can modify other users' profiles—including administrators—by manipulating user IDs in API requests. This allows disabling accounts, altering contact information, or conducting impersonation attacks, effectively locking out legitimate administrators and disrupting operations.
Technical details
The vulnerability is an improper authorization flaw (CWE-269) in the UserController#update endpoint (/orion/api/user/update). The endpoint lacks role-based access control (@RequireRole annotation) and accepts caller-supplied user IDs without validation. Although the service layer protects the roleType field, it allows modification of status, nickname, phone, and email for any user. An authenticated attacker can disable administrator accounts by setting their status to "disabled", or tamper with user metadata. The vulnerability requires authentication but is remotely exploitable via HTTP POST. No official fix has been published as of the advisory date.
Affected products
- OrionSec Orion-Ops up to commit 5925824997a3109651bbde07460958a7be249ed1
Timeline
- 2025-12-01: disclosed
- other: Exploit published; vendor contacted but did not respond