AlertEnterprise Guardian Incorrect Access Control Vulnerability Allowing Manager Approval Bypass

A vulnerability exists in AlertEnterprise Guardian versions through 4.1.14.2.2.1 that allows remote authenticated users to bypass manager approval in the access request process. This is achieved by manipulating the 'isAddedByApprover' parameter in a Request Building Access requestSubmit API call. As a result, users can approve or revoke access requests without the necessary managerial authorization.

Impact

Exploitation of this vulnerability allows for unauthorized approval or revocation of access requests, potentially leading to improper access rights being granted or removed.