AIKIDO-2025-10487

TL;DR

Affected versions of the package are vulnerable to improper privilege management, allowing users with read-only LDAP roles to access functionality beyond their intended permissions. Specifically, a user authenticated via LDAP with read-only privileges is incorrectly granted access to the "Add User" button in the user interface. While this may not immediately result in user creation, exposing administrative UI elements to unauthorized users increases the risk of privilege escalation, accidental misuse, or exploitation through other vulnerabilities. Proper role-based access control should ensure that only users with explicit administrative privileges can view or interact with user management features.