TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Eap_controller | Tp-link | 2.5.4 (including) | 2.5.4 (including) |
| Eap_controller | Tp-link | 2.6.0 (including) | 2.6.0 (including) |