Windu CMS Broken Access Control Vulnerability Allowing Deletion of Super Admins

A broken access control vulnerability has been identified in Windu CMS version 4.1, allowing privileged users to delete Super Admin accounts through a manipulated GET request. This action cannot be performed via the graphical user interface. The vulnerability arises from improper authorization checks in the user editing feature, enabling administrators to exploit the flaw and remove Super Admins without following the standard procedural constraints.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of Super Admin accounts, disrupting administrative oversight and potentially allowing for further abuse of privileges or manipulation of the content management system.