CVE-2026-5781

An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, allows an authenticated user with user modification privileges to escalate their privileges by sending an HTTP request with a manipulated 'identifier' field. Successful exploitation could allow an authenticated user to obtain administrator privileges.

Privilege escalation by an authenticated user could lead to unauthorized access to sensitive data and administrative functions, posing a serious security threat to the organization.

It is recommended to restrict access to the '/minerva/moUser/update' endpoint and implement additional verification mechanisms for user privileges before performing modification operations.