One Incorrect Access Control Vulnerability in User Management API

A vulnerability allowing incorrect access control has been identified in One version 1.0. This issue enables attackers to access sensitive information through the user management API, bypassing authentication requirements. The vulnerability arises from inadequate access controls that fail to properly restrict access to authenticated users.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive information via the user management API.

Reproduction

To reproduce this vulnerability, send a request to the '/api/user/manager' endpoint without authentication. This request will be denied. However, by sending a request to '/static;/../api/user/manager', it is possible to bypass authentication and gain access to the sensitive information.