Summary
Bender is publishing this advisory to inform customers about a security vulnerability in the Customer&Partner platform.
The issue allows any account to view the roles of other users.
Bender has analyzed the weakness and determined that user information and user credentials are not affected. Bender considers the weakness to be of medium risk which should be patched.
Impact
The vulnerability allows a user to view a list of roles, which should be accessible by admin only. The application lacks to implemented an authorization check to view user role requests.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| Customer&Partner | vers:semver/>=5.0.0|<5.17.5 |
Vulnerabilities
Expand / Collapse allA low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.
Acknowledgments
Bender GmbH & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination
- Noah Willams from Bulwarkers Websecurity Pvt. Ltd. for reporting
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 13.10.2026 16:00 | initial version |