AIKIDO-2025-10203

TL;DR

Affected versions of this package are vulnerable to broken access control in the executeCreateAction and executeUpdateAction methods. Insufficient validation in these actions allows users to create or update accounts outside their own company. An attacker can exploit this by forging requests to manipulate users in other companies, potentially leading to privilege escalation or unauthorized access.