Terminalfour Privilege Escalation Vulnerability in User Management Function

A vulnerability in Terminalfour versions 8.0 through 8.4.1.1 allows Power Users to bypass server-side authorization checks in the user management function. This exploitation enables them to assign the Administrator role to lower-privileged accounts or escalate privileges of newly invited lower-privileged accounts. Additionally, Power Users can change the target account's password, gaining full control over the account.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling lower-privileged users to gain administrative rights and control over other accounts.

Remediation

Users are advised to update to Terminalfour version 8.4.1.2, where this vulnerability has been fixed.