Improper handling of insufficient permissions in Tridium Niagara Framework and Niagara Enterprise Security allows a user with lower privileges to obtain higher permissions. This flaw is mapped to CWE‑280, an improper access control weakness. When an attacker exploits the vulnerability, they can gain unauthorized access to system functions or data, potentially altering control logic or accessing sensitive configuration information.

Tridium Niagara Framework and Niagara Enterprise Security running on Windows, Linux, and QNX are affected. Versions prior to 4.14.6 and prior to 4.15.5 for each product are vulnerable.

The CVSS score of 5.2 indicates moderate severity. An EPSS score of less than 1% suggests a low probability that the vulnerability will be exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog. The description does not specify a precise attack vector; based on the nature of privilege abuse, the likely vector is local access with adequate user credentials, though remote exploitation cannot be ruled out but is not confirmed.