Executive brief
A security flaw in the Bonsai content management system allows users with 'Editor' permissions to gain full 'Administrator' control. By bypassing intended access restrictions, an Editor can modify system settings, change user passwords, and create new administrative accounts. This could lead to a complete takeover of the platform and unauthorized access to sensitive organizational data.
Technical details
An incorrect access control vulnerability exists in the AdminAuthHandler of impworks Bonsai v6.0. The handler permits requests from both Administrator and Editor roles, but subsequent sensitive controllers—specifically UsersController and DynamicConfigController—fail to perform secondary role-based validation. Consequently, an authenticated user with Editor privileges can directly access administrative endpoints to perform user management and global configuration mutations. This allows for vertical privilege escalation, enabling an attacker to modify user roles, change passwords, or alter system-wide settings via the UsersManagerService.
Affected products
- impworks Bonsai 6.0
Timeline
- 2026-06-13: disclosed: Initial discovery/write-up active on GitHub Gist.
- 2026-06-15: advisory: CVE published to the NVD.