Authorization Bypass in PatrowlManager API

PatrowlManager versions through 1.8.4 are susceptible to an authorization bypass vulnerability due to a failure to enforce ownership filtering within the application's events and alerts API endpoints. This security flaw allows any authenticated user to interact with data outside of their assigned scope. By manipulating requests to specific API routes, an attacker can read sensitive platform event history, delete events, or modify alerts belonging to other users or departments. Because the vulnerability exists at the API layer, it requires an existing authenticated session but does not require administrative privileges. This poses a significant risk to the integrity and confidentiality of security operations data within organizations utilizing PatrowlManager for vulnerability and threat management.

Impact

Successful exploitation of this vulnerability results in unauthorized access to sensitive security event logs and alert management functions. Impacted organizations face potential data loss through the deletion of security alerts and the exposure of proprietary platform usage patterns. Given the context of PatrowlManager as a security orchestration and vulnerability management tool, unauthorized modification of alerts can be leveraged to suppress incident visibility, potentially facilitating a wider, undetected security compromise.

Recommendation

Prioritize the immediate upgrade of all PatrowlManager instances to a patched version beyond 1.8.4 as soon as the vendor makes a fix available. Until patching is completed, implement strict access controls on the network to limit the exposure of the application's management interface to trusted internal networks only. Monitor web server logs for high-frequency or anomalous API requests targeting the /events or /alerts endpoints from non-administrative service accounts.