Executive brief
Pachno, an open-source collaboration and project management platform, contains a security flaw that allows regular users to gain administrative access. By manipulating a specific browser cookie, an attacker can trick the system into switching their session to that of an administrator. This could lead to the exposure of sensitive company data, password hashes, and full control over the platform's operations.
Technical details
An authentication bypass vulnerability exists in Pachno version 1.0.6 and earlier within the runSwitchUser() action. The flaw is classified as an Authorization Bypass Through User-Controlled Key (CWE-639), where the application relies on a client-side cookie named 'original_username' to manage user switching functionality. An authenticated attacker with low privileges can modify this cookie to an arbitrary value and request a switch to user ID 1 (typically the administrator). Successful exploitation allows the attacker to hijack administrative sessions and retrieve sensitive information such as session tokens or password hashes.
Affected products
- Pachno Pachno <= 1.0.6
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory