CVE-2024-57190: Erxes Incorrect Access Control vulnerability

Severity: Critical

CVSS Score: 9.8

Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint.