Kaleris YMS Access Control Vulnerability in Version 7.2.2.1

A broken access control vulnerability exists in Kaleris YMS version 7.2.2.1. It allows authenticated users with the shipping/receiving role to access the truck dashboard resources, which should be restricted. This vulnerability arises from incorrect access control mechanisms that fail to properly limit resource visibility based on user roles.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive dashboard resources, potentially allowing users to view or manipulate information they should not have access to.

Reproduction

To reproduce this vulnerability, log into the Kaleris YMS application with a user account assigned the shipping/receiving role. Once logged in, navigate to the truck dashboard resources. The access will be granted despite the user's role not being authorized to view such information.