Incorrect Access Control in Changeweb Unifiedtransform

Changeweb Unifiedtransform version 2.0 is susceptible to an incorrect access control vulnerability tracked as CVE-2025-46203. The issue resides within the UserController's editStudents() method, which fails to properly validate user permissions when accessing the /students/edit/{id} endpoint. This flaw permits non-administrative users, including teachers and students, to submit unauthorized modifications to student records that should be restricted to administrative roles. The vulnerability is exploitable over the network without requiring prior authentication beyond a valid (low-privilege) user session, leading to potential data integrity compromise and privilege escalation within the school management system.

Attack Chain

1. Attacker authenticates to the Unifiedtransform application using standard student or teacher credentials.
2. Attacker enumerates existing student IDs through the application UI or by observing URL patterns.
3. Attacker constructs a malicious HTTP GET or POST request targeting the /students/edit/{id} endpoint.
4. The application processes the request in the UserController.editStudents() method without verifying if the user has administrative privileges.
5. The backend executes the database update operation using the attacker-supplied data.
6. The application returns a successful response, confirming the unauthorized modification of the target student record.
7. Attacker successfully escalates privileges or corrupts student record data.

Impact

Successful exploitation allows unauthorized users to modify sensitive student information, leading to data integrity issues. This privilege escalation vector undermines the administrative access control model of the Unifiedtransform platform, potentially allowing malicious actors to manipulate grades, personal identifiers, or academic records.

Recommendation

• Monitor web server logs for HTTP requests to the /students/edit/ pattern originating from accounts not associated with administrative roles.
• Audit access controls within the UserController logic to ensure that editStudents() enforces authorization checks.
• Implement strict session-based role validation for all administrative endpoints.
• Patch or update the Unifiedtransform instance to a secure version if available.