WS-2022-0260

An Insecure Direct Object References IDOR vulnerability was found in kareadita/kavita prior to 0.5.4.1. The password change function doesn't properly handle the Change Password role, allowing to any user, that has this role enabled, to change the password of any user in the system, including the...