Q-Free MaxTime Missing Authorization Vulnerability in User Group Management

A missing authorization vulnerability has been identified in Q-Free MaxTime versions through 2.11.0. This vulnerability allows authenticated low-privileged attackers to remove users from groups by sending crafted HTTP requests. The issue is located in the user-groups routing file.

Impact

Exploitation of this vulnerability allows authenticated low-privileged remote attackers to remove users from groups, thereby revoking their access rights.

Remediation

No official solution has been communicated by the vendor. As a temporary measure, it is recommended to periodically review user and group configurations in the management web application for Q-Free MaxTime versions through 2.11.0, ensuring all settings are correct. Additionally, review all accounts in the same management web application and delete any unnecessary ones.