Title: Privilege Escalation in Beakon Application versions prior to 5.4.3

Description:

Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights.

Source Name: g30ff1rl
CVE: CVE-2025-55373 (Reserved for now)
Affected Software: Beakon Software
Affected Versions: versions prior to 5.4.3
Software URL: https://beakon.com.au/, https://beakon.io/

Proof of Concept/Content:

An authenticated user with low privileges (e.g., contractor employee, 'user') can exploit this vulnerability by directly sending crafted requests (e.g., creating a user by using administrator's user role ID). Due to missing or improper authorization checks, the low privilege user can create its own rogue higher-privileged users (e.g., administrator), which results into elevating the privilege to become administrator.