Q-Free MaxTime Missing Authorization Vulnerability Allowing User Deletion

A missing authorization vulnerability has been identified in Q-Free MaxTime versions through 2.11.0. This vulnerability allows authenticated low-privileged attackers to delete users by sending crafted HTTP requests.

Impact

Exploitation of this vulnerability enables authenticated low-privileged remote attackers to delete users, potentially disrupting access to important accounts.

Remediation

Until an official patch is released, it is recommended to regularly review user and group configurations in the management web application of Q-Free MaxTime devices running versions through 2.11.0. Confirm that all settings are correct and remove any unnecessary accounts.