An arbitrary user data manipulation flaw exists in SourceBans Material Admin before v.1.1.6, allowing attackers to change any user record by sending a crafted XAJAX request to the web application. The vulnerability permits unauthorized alteration of user information or privileges, resulting in integrity violations. Based on the description, it is inferred that the request handler lacks adequate checks on the caller’s identity or the data being modified, enabling arbitrary changes.

Any installation of the SourceBans Material Admin web app that runs a version earlier than 1.1.6 (commit 3ecd95e or earlier) is affected. This includes all versions prior to that commit and does not apply to later releases.

The exploit requires the attacker to send a crafted XAJAX request to the publicly exposed web interface, so the attack vector is likely network based. The EPSS score is < 1% and the CVSS score is 7.3, and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of real-world exploitation. Nevertheless, because no explicit authentication checks were reported, the risk to the integrity of user data is moderate but could be high if an attacker has access to the endpoint.