Executive brief
GazellePW is a community-based content management system with API functionality for user management. An unprivileged user with a valid API token can enable or disable any user account on the platform without proper authorization checks, potentially locking out administrators or gaining control of user accounts.
Technical details
A broken access control vulnerability exists in the GazellePW API user endpoint (app/API/User.php) where the enableUser() and disableUser() methods lack proper authorization verification. An authenticated user with a valid API token can invoke the req=enable or req=disable action to manipulate the Enabled status of arbitrary user accounts by supplying a target user_id or username parameter. The vulnerable code does not verify that the requestor has the necessary privileges before executing account enable/disable operations. This allows any authenticated API user to perform administrative actions, effectively escalating their privileges. The issue affects commit 86c4bedf727691b5a97af42a4864869d18446449 and likely other versions before patching.
Affected products
- Mosasauroidea GazellePW commit 86c4bedf727691b5a97af42a4864869d18446449 and prior
Timeline
- 2026-08-25: disclosed