Improper access control in Doorman allows any authenticated user to change the role field of their own account via the /platform/user/{username} endpoint. The update model accepts the role property without checking for manage_users permission on self‑updates, permitting escalation to high‑privileged roles. This yields full administrative capabilities for the user, potentially leading to uncontrolled system changes and data exposure.

Doorman versions 0.1.0 and 1.0.2 are vulnerable. The product is an open‑source access control service. The problem exists in the user account management API endpoint /platform/user/{username}.

The vulnerability requires authentication and access to the REST API; an attacker with a legitimate session can identify their username and send a patch request to elevate their role. No publicly disclosed exploits or patch notes are available, and the EPSS score is unknown while KEV indicates the vulnerability is not yet exploited. The lack of a permission check means the flaw can be leveraged by any authenticated user, making the risk high within a compromised user base or after a credential compromise.