CVE-2023-35937

CVE-2023-35937 is a critical access control vulnerability affecting Metersphere versions prior to 2.10.2 LTS, an open-source continuous testing platform. This flaw allows authenticated, ordinary users to bypass permission checks on key APIs, enabling them to execute actions typically reserved for space or project administrators, such as elevating their own privileges. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low complexity and no user interaction, potentially leading to complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.