# GHSA-34p4-7w83-35g2 Vulnerability Analysis

## Summary
Formwork 2.3.3 contains a privilege escalation vulnerability in the user creation functionality.
An authenticated user with the "editor" role can create a new user with "admin" privileges,
allowing complete takeover of the CMS.

## Vulnerable Code Location
File: `formwork/src/Panel/Controllers/UsersController.php`
Method: `create(UserFactory $userFactory)`
Lines: 59-66 (approximate)

## Vulnerable Code Pattern
```php
// Get the role
$roleId = $form->data()->get('role', 'user');

if (!$this->site->users()->roles()->has($roleId)) {
    $this->panel->notify($this->translate('panel.users.user.cannotCreate.invalidRole'), 'error');
    return $this->redirect($this->generateRoute('panel.users'));
}
```

## The Issue
The code reads the `role` parameter directly from the form data and only validates that:
1. The role exists in the system

It does NOT validate that:
2. The current user has permission to assign that specific role

## Exploitation Steps
1. Authenticate as a user with the "editor" role
2. Navigate to the Users section and click "New User"
3. Fill in the user creation form
4. Intercept or modify the form submission to include `role=admin`
5. Submit the form
6. The new user is created with admin privileges

## Impact
- Complete compromise of the CMS
- Ability to modify all users, pages, and system settings
- Access to all site data

## CVSS Score
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

## Fix
Update to Formwork 2.3.4 or later.

The fix adds privilege validation:
```php
$currentUser = $this->panel->user();

// Prevent non-admins from escalating privileges
$role = $currentUser->isAdmin() 
    ? $form->data()->get('role') 
    : $currentUser->role()->id();
```