Liquidfiles versions prior to 4.2.12 contain a broken access control flaw that allows an administrator in a secondary domain to elevate privileges to system administrator by modifying a group in that secondary domain; the flaw permits unauthorized modification of group membership, directly granting sysadmin rights.

The affected product is Liquidfiles. Versions before 4.2.12 are vulnerable; the issue occurs within secondary (non‑default) groups and can be triggered by users with administrative rights in those secondary domains.

The CVSS score of 5.9 indicates medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation at this time. The attack vector likely requires an attacker with admin rights in a secondary domain, so the risk is largely contained to users who are already privileged within that domain.