The vulnerability in APTRS causes a privilege escalation flaw. The edit_user API endpoint accepts a JSON body that can include the field 'is_superuser'. The serializer defines this field as writable, so any authenticated user who can hit the endpoint can set the field to true. When this flag is set, the affected account becomes a superuser, giving unrestricted access to all application functionality without initiating a new login session. The weakness arises from incorrect mass assignment handling and lack of permission checks (CWE-915).

APTRS is a Django‑based automated penetration testing reporting system maintained by APTRS. Versions of the software released before 2.0.1 are affected. Any deployment of these earlier releases that exposes the /api/auth/edituser/<pk> endpoint to authenticated users is vulnerable. The issue has been fixed in the 2.0.1 release and later.

The flaw carries a CVSS score of 9.4, indicating critical severity. Although EPSS data is unavailable, the vulnerability can be exploited without special conditions; an attacker only needs to be authenticated to the system and be able to reach the edit_user endpoint. Because no re‑authentication is required after setting the flag, an attacker can effortlessly gain superuser privileges. The vulnerability is not listed in CISA’s KEV catalog, but its high CVSS rating and simple exploitation path warrant immediate attention.