An authenticated non‑administrator user can elevate privileges by exploiting a lack of enforcement on field restrictions during nested relational record persistence. By submitting changes through a related entity’s save pathway, the user can assign administrator roles or alter group memberships on a User record, bypassing the USER_RESTRICTED_FIELDS control and causing the JPA persistence layer to flush attacker‑supplied admin role and group assignments upon commit. This results in the attacker gaining full administrative access to the application with all associated functionality and data.

Axelor Open Platform versions 8.x prior to 8.2.2 are affected, encompassing all product bundles that ship the 8.x release series from axelor:axelor-open-platform. Any installation running the 8.x code with the nested relational persistence logic in place is at risk if it does not update or otherwise restrict modifications to protected user attributes.

The CVSS score of 8.7 classifies the flaw as high severity, whereas the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability requires only an authenticated session, and the flaw can be exercised via the web or API interface that handles nested save operations; the likely attack vector is through crafted nested persistence requests. Despite not being listed in the CISA KEV catalog, the vulnerability is confirmed by multiple publicories and can lead to full administrative control if not remediated. Organizations should treat it as a priority for remediation.