CVE-2022-38577

HighCVSS 8.8

Published: 19/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.45%

70th percentile - higher than 70% of all known CVEs

Summary

ProcessMaker before version 3.5.4 was found to have insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to administrators.

Risk Assessment

The risk is that a regular user can gain unauthorized full control over the system, potentially compromising data confidentiality, integrity, and availability.

Recommendation

Immediately update ProcessMaker to version 3.5.4 or later, which includes a fix for this vulnerability.

Other vulnerabilities in ProcessMaker

CVE-2026-107803Medium
ProcessMaker before version 2026.14.3 is vulnerable to SQL injection in the `GET /api/1.0/tasks` endpoint via the `order_by` parameter. The `applyColumnOrdering()` method concatenates a user-controlled `process_requests` column name into a SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account.

Original NVD description (English source)

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS