High severity8.8NVD Advisory· Published Jan 31, 2024· Updated Jun 17, 2026

CVE-2024-24573

Description

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Facilemanager/Facilemanagerllm-fuzzy
Range: <=4.5.0
WillyXJ/facileManagerv5
Range: <= 4.5.0

Patches

Vulnerability mechanics

References

github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877nvdPatch
github.com/WillyXJ/facileManager/security/advisories/GHSA-w67q-pp62-j4pfnvdExploitVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000