MajorDoMo’s market module contains an admin() method that reads a 'mode' parameter from the request and assigns it to a class property without any authentication checks. When this endpoint is accessed via /objects/?module=market, the code path that handles the 'uninstall' mode becomes reachable. The handler calls uninstallPlugin(), which removes database entries for the target module, evaluates the module’s uninstall() method with eval(), recursively deletes the module’s directory and template files, and removes associated cycle scripts. By iterating over existing module names with unauthenticated GET requests, an attacker can delete individual modules or effectively wipe the entire MajorDoMo installation. This missing authorization flaw (CWE‑862) enables arbitrary deletion of application components, resulting in loss of functionality and potential denial of service.

MajorDoMo (sergejey:MajorDoMo) – all versions are affected; no version constraints are specified.

The CVSS score of 8.7 reflects the high impact of this flaw. The EPSS score is below 1 %, indicating a low probability of exploitation at the moment, and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: an unauthenticated attacker sends HTTP GET requests to the /objects/?module=market endpoint, and does not require any other privileges or elevated access. If exploited, the attacker can permanently delete modules or the complete system, making this a significant availability and integrity threat for unattended installations.