I found four vulnerability related to user management authority.

[k3ppf0r]

Verison

master branch

Vulnerability List

The first Vulnerability :14Finger User Sensitive Information Leakage Vulnerability The second vulnerability: 14Finger User privilege escalation vulnerability The third vulnerability: 14Finger Arbitrary user deletion vulnerability The fourth vulnerability: 14Finger Arbitrary User Password Reset Vulnerability

Summary:

14Finger does not strictly verify the identity permission of the current user operation, which causes the user to operate functions beyond the scope of his/her management permission, thus operating some behaviors that the user cannot operate.

Repair suggestions：

1. API authentication
2. principle of least privilege

For more vulnerability details, please refer to the PDF. 14Finger User Sensitive Information Leakage Vulnerability.pdf 14Finger User privilege escalation vulnerability.pdf 14Finger Arbitrary user deletion vulnerability.pdf 14Finger Arbitrary User Password Reset Vulnerability.pdf