An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector through which the user is able to execute any program with elevated privileges.
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.