CVE-2026-67687 Details

A vulnerability allowing vertical privilege escalation has been identified in ICS-Park Smart Park Management System version 2.0. This issue arises from insecure permissions in the RoleController and UserController, enabling authenticated ordinary users to create administrator accounts with full privileges. The vulnerability exploits two missing authorization checks: the role creation endpoint lacks proper permission validation, and the user update endpoint is accessible to users with the default 'common member' role, which includes editing permissions. By leveraging these gaps, an attacker can craft a role with extensive permissions, assign it to their account, and subsequently create administrator-level users.

To address this vulnerability, the 'RoleController.save()' method should be annotated with '@HasPermissions("system:role:add")' to enforce proper permission checks. Additionally, the authorization model should be revised to default to denying access unless explicitly permitted, ensuring that all management endpoints are properly audited and annotated with the correct permissions.