The vulnerability, classified as CWE-862, has a CVSS score of 8.7, indicating high severity. It allows an attacker to create an API token on behalf of another user because the internal POST /api/users/~/{user}/tokens endpoint fails to verify that the requesting user has permission to create tokens for that target user. This omission enables privilege escalation: an attacker who can authenticate to the Dashboard using OAuth/OIDC and who knows the login name of a more‑privileged internal user could create a token for that user, gain that user’s OAuth/OIDC credentials, and, if the target user was an administrator, obtain full administrative control of the Dashboard. In some configurations, combined with other weaknesses, the attacker could further elevate to code execution on the host system under the OS‑user running the Dashboard server.

The affected product is the Axivion Dashboard from Qt Axivion. All releases before the following fixed versions are vulnerable: 7.9.13, 7.10.11, 7.11.7, and 7.12.2. Deployments running any 7.8.x release from 7.8.5 through 7.8.12 lack a fix, so they must migrate to one of the fixed releases to protect the system.

The CVSS score is 8.7, indicating high severity, and the EPSS score is <1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an existing internal user with higher privileges, knowledge of that user’s login name, and the ability to authenticate to the Dashboard via OAuth/OIDC. Thus the likely attack vector is through internal or compromised accounts that can authenticate, enabling the attacker to create a token for a privileged user and, if that user is an administrator, gain full administrative control. If combined with other weaknesses, the attacker could also achieve code execution on the host system.