Technical impact
This vulnerability is an incorrect privilege assignment flaw that allows a user to elevate their rights beyond the intended level. It is classified as a high severity flaw with a CVSS score of 9.8 and is identified as CWE-266.
Affected Systems
The flaw affects Themeisle Masteriyo LMS PRO, with all releases up through 2.20.0 vulnerable. Users must check that their instance is not running a version earlier than 2.20.1 which contains the fix.
Risk and Exploitability
The CVSS score indicates a critical impact and the lack of a listed KEV status suggests an absence of known public exploitation, though the EPSS score is not available. The attack vector is not explicitly stated in the description; based on the nature of privilege assignment issues it is inferred that an attacker would need the ability to create or edit content within the LMS or have a user account with limited permissions to misuse the flaw. Exploitation would raise the attacker’s privileges to a level that permits management or full administrative functions within the LMS.
