CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated users to manipulate club records by sending direct requests to update or activate actions without any ownership verification. This could lead to unauthorized modifications or publication of sensitive information. Organizations utilizing this extension should prioritize patching this issue to prevent potential data integrity breaches.
Original NVD Description
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.