CVE-2020-36902

Critical · 9.8

CVSS

9.8

EPSS

1.1%

Published

Dec 10, 2025

CISA due date

—

The record

UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.

Affected packages

Ecosystem	Package	Introduced	Fixed