CVE-2024-40408: Critical access control vulnerability in Cybele Software Thinfinity Workspace allows attackers to create arbitrary user profiles with elevated privileges. Discover a significant security risk in Thinfinity Workspace, potentially enabling unauthorized access and control.

CVE-2024-40408 exposes a critical flaw in Cybele Software Thinfinity Workspace before v7.0.2.113, specifically within the Create Profile section. An attacker can exploit this vulnerability to create user profiles with elevated privileges, bypassing intended access controls. Despite a CVSS score of 0, the SOCRadar Vulnerability Risk Score (SVRS) indicates a score of 30, suggesting a moderate risk. However, the "In The Wild" tag indicates that exploits for this CVE have been observed, increasing the potential impact. Successful exploitation could lead to unauthorized access, data breaches, and system compromise. Organizations using affected versions of Thinfinity Workspace should prioritize patching to prevent potential abuse and mitigate this critical risk.