Admin changing User level via More Actions button

Backend functionalities: user management, course management, reports, certificates, etc.
Post Reply
Graeme59
FormaLms User
Posts: 120
Joined: Thu May 05, 2016 6:53 am
Version: forma.lms 2.0
Location: UK
Contact:

Admin changing User level via More Actions button

Post by Graeme59 »

Hi,
I found a user who had been made a Super admin by an Admin, in error.

The Admin had used the More Actions option in the Organisation chart to edit a user's password, they had ticked the New password, populated the boxes and also ticked the Level which by default is set to Super admin.

This resulted in a level change, giving a user, Super admin privileges and access to all user's details.

This was in a site running 3.01, I have tested it and it is still possible in 4.0.7.

Can this be amended in the Administrator profile settings?
Super admin.PNG
See image
Cheers
Graeme
alfa24
Senior Boarder
Posts: 2047
Joined: Fri Nov 24, 2017 8:45 am

Re: Admin changing User level via More Actions button

Post by alfa24 »

Hi Graeme, it's not a bug, but I agree, an Admin should not be capable of changing levels at all, or, if needed, should not be capable of elevating levels. This is a privilege escalation vulnerability of Forma.
Per supporto GRATUITO contattatemi in privato qui
Graeme59
FormaLms User
Posts: 120
Joined: Thu May 05, 2016 6:53 am
Version: forma.lms 2.0
Location: UK
Contact:

Re: Admin changing User level via More Actions button

Post by Graeme59 »

Hi,
I agree Admins have no need to change levels.
It’s also a GDPR risk which is a concern.
🙁
Graeme
User avatar
max
FormaLms Guru
Posts: 2739
Joined: Thu Mar 01, 2012 10:41 am
Version: forma.lms 2.4
Contact:

Re: Admin changing User level via More Actions button

Post by max »

Hello,
got it, we'll get back with a fix asap
---------------------
Massimiliano Ferrari
Elearnit - Elearning e Knowledge Management
https://www.elearnit.net
https://www.linkedin.com/in/massimilianoferrari
m.ferrari[at]elearnit.net
Skype: m_ferrari_it
Graeme59
FormaLms User
Posts: 120
Joined: Thu May 05, 2016 6:53 am
Version: forma.lms 2.0
Location: UK
Contact:

Re: Admin changing User level via More Actions button

Post by Graeme59 »

Hi Max,
Thank you.
Cheers
Graeme
Post Reply