IKUS Rdiffweb Improper Authorization Vulnerability Allowing Token Impersonation

An improper authorization vulnerability has been identified in IKUS Rdiffweb versions prior to 2.10.5. This vulnerability allows an attacker with a valid or stolen access token to impersonate other users. The issue arises because the API fails to properly bind the authenticated user to the targeted user or tenant, enabling crafted requests to access or modify data belonging to other users. In some cases, this vulnerability could be exploited to perform privileged actions, potentially leading to cross-tenant access.

Impact

Exploitation of this vulnerability could result in unauthorized access to user data and the ability to perform actions on behalf of other users, including privileged actions.

Remediation

Users are advised to upgrade to IKUS Rdiffweb version 2.10.6 or later, where this vulnerability has been fixed.