Auth bypass in Mops
CVE-2024-55585
In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword.
Vulnerability class: Broken Authentication
EPSS: 0.004 (27.8th percentile) — read the EPSS interpretation.
Affected products
- Mops — versions 0