Executive brief
Axelor Open Platform, a business application development framework, contains a security flaw that allows standard users to grant themselves administrative privileges. By exploiting how the system handles updates to related records, a user can bypass security restrictions intended to protect sensitive account fields like roles and groups. This could lead to a full takeover of the application, allowing unauthorized access to sensitive business data and administrative functions.
Technical details
An authorization bypass exists in Axelor Open Platform's RPC resource handling. While the platform implements a 'USER_RESTRICTED_FIELDS' control to prevent non-admins from modifying sensitive User fields (roles, groups, permissions), this check is only enforced on top-level User save operations. An attacker can bypass this by submitting a save request for a different entity that has a relationship to a User (e.g., a Team). Because the nested relational save path only checks for general write permissions and fails to apply the restricted-field logic, the JPA persistence layer will update the managed User entity with attacker-supplied roles or groups. This allows a low-privileged user to promote themselves to an administrator. The issue is fixed in version 8.2.2.
Affected products
- Axelor Axelor Open Platform 8.x prior to 8.2.2
Timeline
- 2026-06-03: disclosed: Reported to maintainer via email
- 2026-06-04: other: Maintainer confirmed vulnerability
- 2026-06-18: patched: Version 8.2.2 released
- 2026-07-16: advisory: NVD/VulnCheck advisory published