Impact

Exploitation allows an authenticated user to achieve full administrative control over the smart-sso environment. This includes the ability to modify user roles, perform password resets, and gain management access to integrated systems linked to the SSO platform.

Recommendation

• Update smart-sso to a version beyond 2.0.1 that addresses the permissive authorization logic in PermissionFilter.
• Audit access logs for unauthorized requests to the '/admin/' path hierarchy made by non-administrative user accounts.
• Configure the web server or application firewall to explicitly deny access to administrative API endpoints for all users except those assigned to the administrator role.