CVE-2026-38807 Details

A vulnerability allowing unauthorized privilege escalation has been identified in kvf-admin version 1.0.0. This issue arises from the UserController component, which lacks proper permission checks and object ownership validation. As a result, authenticated low-privileged users can manipulate other users' profiles, including administrative accounts. The vulnerability stems from a business logic flaw that enables vertical privilege escalation by exploiting the application's failure to restrict access based on user roles.

To address this vulnerability, implement server-side checks to ensure that users can only modify their own profiles. Authorization validations should be enforced before processing profile updates, and sensitive information such as usernames and roles should be protected with allowlists or separate administrative APIs.