CVE-2024-31525 Privilege escalation in n/a
A regular user can escalate privileges to admin due to client-side only authorization checks, allowing persistent administrative access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-31525?
CVE-2024-31525 is a high-severity vulnerability in n/a, published on 5 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator.
Weakness: CWE-306
Which versions are affected by CVE-2024-31525?
How do I fix CVE-2024-31525?
No fix has been published for CVE-2024-31525 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-31525 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-31525 exists.
Sources
Also known as GHSA-p67q-hj2w-25v7.