Becon DATAGerry Incorrect Access Control Vulnerability in REST API Endpoint

A broken access control vulnerability has been identified in the Becon DATAGerry platform, affecting all versions through 2.2.0. The vulnerability resides in the '/rest/rights/' REST API endpoint, which can be accessed remotely without authentication. This flaw allows unauthorized users to gain access to sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access and disclosure of sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to the '/rest/rights/' endpoint without authentication. The response will include sensitive information that should not be accessible without proper authorization.