ProjeQtor versions 7.0 through 12.4.3 have a missing authorization flaw in the objectDetail.php endpoint that lets any authenticated user with guest permissions retrieve sensitive data belonging to other users, including password hashes and API keys. This flaw also enables attackers to obtain administrator credentials, enabling privilege escalation. The weakness is an Authentication Bypass (CWE‑862).

The affected products are ProjeQtor, a software project management platform, specifically versions 7.0 to 12.4.3. All installations of these versions run the vulnerable objectDetail.php endpoint.

The CVSS score is 7.1, indicating a high severity of vulnerability. Although a precise EPSS score is unavailable, the lack of a KEV listing suggests no publicly disclosed exploit yet. Attackers require authentication with guest‑level access, so the risk is primarily internal or on networks where legitimate users have guest accounts. If the endpoint is reachable, an attacker can easily retrieve privileged data and elevate privileges.