AlertEnterprise Guardian Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in AlertEnterprise Guardian version 4.1.14.2.2.1 and earlier. This issue allows remote authenticated users to elevate their privileges to administrator level by manipulating the 'IsAdminApprover' parameter in a specific API call. The vulnerability resides in the 'Request Building Access' requestSubmit API endpoint.

Impact

Exploitation of this vulnerability allows authenticated users to gain unauthorized administrator privileges, enabling them to approve or revoke access requests at will.