The vulnerability in DataCap is a missing authorization check that allows any authenticated user to assign themselves the administrator role by calling the /api/v1/user/allocationRole endpoint with a PUT request. As a result, the attacker gains full administrative control of the instance, including the ability to manage roles, menus, and other critical settings. This flaw is a classic privilege‑escalation weakness, categorized as CWE‑862.

The affected software is DataCap from devlive-community. Any deployment running version 2025.1.1 or earlier is vulnerable, as the missing authorization check exists in these releases.

The CVSS base score of 8.7 places this flaw in the high‑severity range, indicating that a successful exploit would provide significant system control. The attack requires only an authenticated session, which self‑registered or low‑privilege accounts can obtain. No public exploits are documented and the EPSS metric is unavailable, but the straightforward API call and lack of authorization make it an attractive target for attackers. The vulnerability is not listed in CISA’s KEV catalog, though its potential impact warrants prompt attention.