CyberRota Analysis
AI-GeneratedUnoPim versions prior to 2.1.3 are vulnerable due to inadequate access control, allowing admin users to bypass permission checks and exploit missing authorization validation in the Bouncer middleware. This flaw enables attackers with minimal admin privileges to create OAuth API integrations and escalate their permissions, potentially compromising sensitive data and system integrity. Organizations using UnoPim should prioritize patching to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware.