Description
A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
Remediation
References
https://hackerone.com/reports/343626
Related Vulnerabilities
CVE-2020-16024 Vulnerability in npm package electron
CVE-2023-46731 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui
CVE-2020-28500 Vulnerability in maven package org.webjars:lodash
CVE-2022-41853 Vulnerability in maven package org.hsqldb:hsqldb
CVE-2023-29210 Vulnerability in maven package org.xwiki.platform:xwiki-platform-notifications-ui