Black Duck SCA Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in Black Duck SCA versions prior to 2025.10.0. The issue arises from user role permissions that were configured too broadly. Specifically, users with the Project Manager role and Global User Read access were able to access certain functionalities meant for Project Administrators. While this vulnerability does not provide full system control, it could allow unauthorized modifications to project configurations or access to sensitive system information.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in project settings or access to confidential system data.

Remediation

Users are advised to upgrade to Black Duck SCA version 2025.10.0.