OpenText Content Server REST API Incorrect Authorization Vulnerability Allowing Unauthorized Removal of External Collaborators

A vulnerability has been identified in the OpenText Content Server REST API, affecting both Windows and Linux platforms. This incorrect authorization issue allows users without the necessary permissions to remove external collaborators. The vulnerability impacts OpenText Content Server versions 20.2 through 24.4.

Impact

Exploitation of this vulnerability could enable an authenticated user with a valid API token to delete external users from a node without having the appropriate permissions.

Remediation

Hotfixes are available for the affected versions of OpenText Content Management for Engineering. This issue is resolved in version 25.2 and subsequent releases. For versions 23.2 to 24.4, hotfixes can be downloaded from the OpenText Support Portal.