Insecure Direct Object Reference - View other user profiles

[natstheway]

Description :
Observed IDOR vulnerability in demo site - https://demo.gleezcms.org/
It will be possible attackers(logged in user) to view profile page of other users.

Version : Gleez CMS v1.3.0

Vulnerability type: Insecure Direct Object Reference

Steps to reproduce :

1. Login as a demo user
   Username : demo
   Password : demo

2. After login, you can observe the URL - https://demo.gleezcms.org/user/3 in the address bar.

3. Change the user ID, from 3 to 4,5,6.

4. You be will be able to view other user name and their profile page.

Impact
The vulnerability if exploited can allow users to view profile of any other user which the user is not entitled to.

The attacker can view the following

1. Username
2. Profile photo
3. Last visited date
4. Joined date
5. Number of visits

[natstheway]

[sandeepone]

This is because default permission enabled for the role. It can be disabled form roles -> permissions ui.
Disable "Access to all profiles"

[natstheway]

Yes. Then kindly disable the same as allowing access would be a insecure configuration.