Source evidence

Security issue

HM Multiple Roles · support · 2021-07-16T13:59:00+00:00

HM Multiple Roles plugin evidence original source source API

neutralsentiment

highseverity

0.58relevance

1replies

Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

6 / 34 rows with source links

17.6% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

28 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support

clemorphy resolved

Hi Any user with a basic role can go to his edit profile page and change his role to admin. I don’t know if this is the intended behaviour, but it can be a real security issue. Thank you @clemorphy for notifying the issue. We have blocked it for non admin user in the latest update. Hope it helps.

Commercial Context

Opportunity

access control and account operations

User access-control assurance for keeping user access, permissions, and protected content correct

Buyer: membership site owners, agencies, and operations teams

Wedge: test user roles, protected content, SSO/login handoffs, and private-data exposure

Proof Blocked card complete market

Analysis

heuristic-v1

Summary: Security issue: users show security, bugs, support pain that may indicate a product gap.

Evidence quote: Security issue Hi Any user with a basic role can go to his edit profile page and change his role to admin.

Affected feature: security

security bugs support

Plugin

API

HM Multiple Roles

1.0K active installs · 28.5K downloads · rating 72.0

role roles user user roles users

Comments

1 shown

Hossni Mubarak 2021-07-19T07:27:00+00:00

Thank you @clemorphy for notifying the issue. We have blocked it for non admin user in the latest update. Hope it helps.