Executive brief
GAPTEQ Designer is a low-code platform used to build web-based business applications without coding. A flaw in the role-based access control allows users with the Company Manager role to access sensitive table data that should only be available to Administrators. An attacker with Company Manager credentials can bypass authorization checks to retrieve restricted information and escalate their privileges within the system.
Technical details
This is a privilege escalation vulnerability caused by improper authorization enforcement in GAPTEQ Designer v.3.5. The Company Manager role lacks proper access control validation when loading table data via POST requests to the /GAPTEQForms/Table/_callback/load endpoint. An authenticated attacker with Company Manager credentials can craft POST requests with specific parameters to load table definitions and data intended only for Administrator accounts. The vulnerability requires valid authentication credentials and network access to the application; a proof-of-concept demonstrates using saved session cookies and XMLHttpRequest calls to bypass role-based restrictions. No patch has been publicly disclosed yet.
Affected products
- GAPTEQ Designer 3.5
Timeline
- 2026-08-17: disclosed
- 2026-08-17: advisory