CVE-2024-40531

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-05 · updated 2026-06-17
Weakness: CWE-284

Description

A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated users to modify any user attribute, including roles, by injecting additional parameters via profile management functions.

Affected products

Uab Lexita Panteracrm Cms: 401.152
Uab Lexita Patera Crm Cms: 402.072

References

https://critical.lt/blog/authorization-bypass-and-mass-assignment-in-pantera-crm/

Get alerted when CVE-2024-40531 or the next vulnerability affects your stack