Squirro Cognitive Search versions prior to 3.14.2 contain a flaw that allows an attacker who can send a specially composed request to the service to acquire elevated privileges. The vulnerability enables a user that has only limited access to increase their permissions, effectively bypassing the intended access controls. This could allow an attacker to read, write or delete sensitive data stored within the search platform, and potentially to move laterally within the broader environment.

The problem exists in Squirro Cognitive Search before v3.14.2. All deployments of the product that have not been upgraded to version 3.14.2 or later are susceptible. No other vendor or product is referenced in the advisory.

The CVSS score is not provided and the EPSS score is missing, so the precise quantitative risk is unknown. The vulnerability is listed in CISA KEV as not present, indicating that no widely known, actively exploited scenarios have been reported yet. However, because the issue is a privilege escalation that can be triggered by an externally crafted request, it is likely that exploitation could occur remotely from over the network, provided the attacker can reach the Cognitive Search service. In the absence of an exploitation probability metric, the condition remains a potential threat until a patch is applied.