Gallagher Command Centre Server Client-Side Enforcement Vulnerability Allowing Expired Competency Data Bypass

A vulnerability in Gallagher Command Centre Server exists in versions 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), and all versions of 9.00 and prior. This issue involves client-side enforcement of server-side security, allowing privileged operators to input invalid competency data that bypasses expiry checks. Only sites utilizing competency expiries for access control are affected.

Impact

Exploitation of this vulnerability could lead to unauthorized access or privileges by allowing the entry of invalid competency data that bypasses established expiry checks, potentially disrupting access control decisions.