CyberRota Analysis
AI-GeneratedA vulnerability exists in a deployment mode designed for read-only access, which improperly exposes API routes without restricting allowed request methods. This flaw enables authenticated users to create or overwrite stored records, leveraging elevated backend credentials, thereby compromising data integrity in environments that should not permit modifications. Organizations utilizing this deployment mode, particularly those handling sensitive data, should prioritize immediate remediation to mitigate potential data manipulation risks.
Original NVD Description
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode.