CVE-2024-28735

Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.72% chance of exploitation in the next 30 days, 51th percentile

Published

2024-03-20

Updated

2026-07-09

Proof-of-concept exploits (1)

• https://packetstormsecurity.com/files/177620/Financials-By-Coda-Authorization-Bypass.html

References

• CVE Record
• NVD entry

Related

• CVE-2024-28734
• CVE-2024-28739
• CVE-2024-28732
• CVE-2024-2874
• CVE-2024-2872
• CVE-2024-28740