title: ifme - Improper Access Control leads to admin deactivation
description: In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.
problem types: CWE-284 Improper Access Control
affected:
{
product: ifme
vendor: ifmeorg
versions:
lessThan: unspecified, status: affected, version: v5.0.0, versionType: custom
lessThanOrEqual: v7.32, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: Update version to v7.32.1 or later