Kentico Xperience Access Control Bypass Vulnerability Allowing Privilege Modification

A vulnerability allowing access control bypass has been identified in Kentico Xperience versions through 12.0.60. This vulnerability enables administrators to alter global administrator user privileges by sending unauthorized requests. As a result, attackers could potentially compromise global administrator accounts and disrupt security-sensitive macros by changing user privilege levels.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of global administrator privileges, allowing attackers to compromise administrator accounts and interfere with security-sensitive macros.

Remediation

Users can apply the latest hotfix available for their Kentico Xperience version. Instructions for applying hotfixes can be found in the Kentico Xperience Documentation.