An authorization flaw exists in the "/minerva/moUser/update" endpoint of MphRx's Minerva version 3.6.0. An authenticated user who already has rights to modify user data can craft an HTTP request that changes the 'identifier' field, causing the system to elevate that user to an administrator. The flaw, categorized as CWE‑285, allows a user to gain full administrative control without using the graphical interface.

The vulnerability affects systems running MphRx's Minerva product, specifically the 3.6.0 release as documented by the CNA. No other versions or variants were mentioned in the advisory, and the vendor has not yet issued an updated release.

The CVSS score of 8.5 indicates high severity, but the EPSS score is not available; it also has not been listed in the CISA KEV catalog. Exploitation requires an authenticated session with user‑modification privileges and the ability to send a specially crafted HTTP request. Since the attack vector involves direct HTTP calls to the vulnerable endpoint, no UI interaction is needed. The absence of listed exploits suggests that active exploitation may be limited, yet the high CVSS reflects the potential for privilege escalation should an attacker discover or weaponize this flaw.