Q-Free MaxTime Missing Authentication Vulnerability in User Permissions Management

A vulnerability allowing unauthenticated remote attackers to edit user permissions has been identified in Q-Free MaxTime versions through 2.11.0. This issue arises from a missing authentication for critical functions, specifically in the file maxprofile/menu/routes.lua. Exploitation can be achieved by sending crafted HTTP requests to the application.

Impact

Exploitation of this vulnerability allows unauthorized users to modify user permissions, potentially leading to unauthorized access to sensitive functions within the application.

Remediation

While an official patch has not been released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.