A missing authorization check in Brave CMS allows any authenticated user to change role data through the POST endpoint /rights/update-role/{id}. Because the assign-user-roles middleware is omitted, a user can promote themselves to Super Admin, giving full control over the system. This is a classic privilege escalation flaw identified as CWE-862 that threatens confidentiality, integrity, and availability by enabling unrestricted administrative actions.

The vulnerability affects Ajax30’s BraveCMS versions 2.0 through 2.0.5. The issue was fixed in release 2.0.6.

The CVSS score of 8.8 denotes high severity, but the EPSS score of less than 1 % suggests a low overall exploitation probability. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker only needs a valid authenticated session and access to the specified POST route, making the attack path straightforward for anyone who can obtain legitimate credentials.