## https://sploitus.com/exploit?id=99AC2A0D-F1CB-5283-9018-678EB80CBB8B
# CVE-2023-32749 | Pydio Cells Unauthorised Role Assignment
Exploit for CVE-2023-32749 affecting Pydio Cells 4.1.2 and earlier. A low-privileged authenticated user can create a new external user with all roles assigned, granting access to all cells and non-personal workspaces across the instance.
## Affected Versions
- Pydio Cells 4.1.2 and earlier
- Fixed in 4.2.0, 4.1.3, 3.0.12
## Requirements
```
pip install requests
```
## Usage
Grab a Bearer token from an authenticated session (DevTools > Network > any `/a/` request > Authorization header), then run:
```bash
python3 pydio_privesc.py
```
**Example:**
```bash
python3 pydio_privesc.py https://cells.example.com "token_here" pwned Pwned123!
```
Log into the Pydio web UI with the newly created account to access all shared cells and workspaces.
## Disclaimer
This tool is intended for authorised penetration testing and educational purposes only. Do not use against systems you do not have explicit permission to test.