Q-Free MaxTime Missing Authentication Vulnerability in User Group Permissions Management

A vulnerability allowing unauthenticated remote attackers to edit user group permissions has been identified in Q-Free MaxTime versions through 2.11.0. This issue arises from a missing authentication for critical functions, specifically in the file maxprofile/menu/routes.lua. Exploitation of this vulnerability could lead to unauthorized changes in user access rights, potentially escalating privileges or restricting access for legitimate users.

Impact

Exploitation of this vulnerability allows for unauthorized editing of user group permissions, which could escalate privileges or restrict access for legitimate users.

Remediation

Until a patch is released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.