Q-Free MaxTime Missing Authorization Vulnerability Allowing Arbitrary User Group Creation

A missing authorization vulnerability has been identified in Q-Free MaxTime versions through 2.11.0. This vulnerability allows authenticated low-privileged attackers to create arbitrary user groups by sending crafted HTTP requests. The issue is located in the 'maxprofile/user-groups/routes.lua' file.

Impact

Exploitation of this vulnerability could lead to unauthorized creation of user groups, potentially allowing for privilege escalation.

Remediation

Until an official patch is released, it is recommended to periodically review user and group configurations in the management web application for Q-Free MaxTime versions through 2.11.0, ensuring all settings are correct. Additionally, review all accounts in the same management application and remove any unnecessary ones.