Verve Asset Manager Access Control Vulnerability

An access control vulnerability has been identified in Verve Asset Manager versions 1.33 through 1.41.3. This vulnerability allows unauthorized read-only users to read, update, and delete user information via the API.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications and deletions of user data through the API.

Remediation

Users of Verve Asset Manager can upgrade to version 1.41.4 or 1.42 to address this vulnerability. For those unable to upgrade, it is recommended to remove any read-only accounts as an additional precaution.