Executive brief
Agorum core open, a document management and collaboration platform, contains a security flaw where it fails to properly verify user permissions for administrative functions. This allows standard users to perform sensitive actions such as deleting files, changing access rights, and viewing system logs. In certain fresh installations, some of these functions may even be accessible to unauthenticated individuals on the network, potentially leading to data loss or unauthorized access to corporate information.
Technical details
The vulnerability is caused by improper access control (CWE-284/CWE-863) in several JSP-based administrative endpoints within the 'roiwebui' module. The application fails to verify if the 'sessionController' has administrative privileges ('isAdminEnabled') before granting access to tools for reindexing, mass deletion, ACL modification, and log downloading. While primarily an authenticated privilege escalation, certain endpoints are accessible without any authentication immediately following a fresh installation. Attackers can exploit this by sending direct HTTP requests to the vulnerable JSP paths to download server logs, view stack traces, or manipulate file permissions. The vendor has released versions 11.9.2 and 11.10.1 which implement the necessary session checks.
Affected products
- Software GmbH Agorum Agorum core open 11.9.1.3-1857 and earlier versions; fixed in 11.9.2 and 11.10.1
Timeline
- 2025-05-05: disclosed: Initial contact with vendor
- 2025-05-30: patched: Vendor released versions 11.9.2 and 11.10.1
- 2025-06-27: advisory: External security advisory published by usd HeroLab
- 2025-07-18: advisory: CVE published to NVD