APTRS exposes a critical privilege escalation flaw in the user edit API. The endpoint accepts a JSON payload that includes the field is_superuser, which is unintentionally writable due to an oversight in the serializer’s definition. An ordinary authenticated user can simply send a request setting is_superuser to true and obtain unrestricted control of the application, bypassing all internal permission checks and privileges. This enables the attacker to read, modify or delete any data, and to reconfigure system settings, effectively taking full control of the reporting platform.

APTRS, the Automated Penetration Testing Reporting System built with Python and Django, is vulnerable in all releases prior to 2.0.1. The issue exists in the POST /api/auth/edituser/<pk> endpoint where any reachable user can submit a mass-assignment payload.

The defect carries a CVSS score of 9.4, indicating very high severity. Exploitation likelihood is low (EPSS < 1%) but the impact is massive should an attacker succeed. The attack vector is straightforward: a user with network access to the API can craft a POST request that sets is_superuser to true. This bypasses authentication checks and provides unrestricted application access. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known active exploits yet.