CVE-2024-7265 is a high severity (CVSS 8.8) authorization flaw in EZD RP, the electronic document management system from NASK-PIB. A logged-in user can change the password of any other user, including root. The fix is to upgrade to a release past the affected range, and to review recent password changes.
What's affected
The NVD record says EZD RP is affected from 15 before 15.84, from 16 before 16.15, and from 17 before 17.2. The weakness is classed as CWE-863, incorrect authorization. The CVSS vector is AV:N/AC:L/PR:L/UI:N, which means a network attacker with a low privilege account and no user interaction.
There is a small source conflict on the 15 line. The record reads "before 15.84", while the CERT Polska advisory lists "15 through 15.84". If you run exactly 15.84, treat it as unconfirmed and ask the vendor, or move to a newer 15.x build. CERT Polska does not publish a separate fixed version table, so the upper boundaries (16.15, 17.2) are implied by the "before" wording. Confirm the exact build with NASK.
Two sibling issues were published in the same advisory: CVE-2024-7266 (a logged-in user can list all users, including those in other organizations) and CVE-2024-7267 (a logged-in user can read information about IP infrastructure and credentials, fixed before 19.6). If you are touching this product, check all three.
How to check if you're exposed
EZD RP is a hosted or self-managed government application, so there is no package manager command that applies. The steps are:
- Find your EZD RP version in the application's administration or about screen, or ask the team that operates the instance.
- Compare it to the ranges above: 15.x below 15.84, 16.x below 16.15, 17.x below 17.2.
- Review the audit log for password changes that were not made by the account owner, especially on administrative and root accounts.
If EZD RP is part of a larger software estate you track, a dependency scan will not see it because it is a packaged product, so record it in your asset inventory by hand.
What to do now
- Upgrade to 15.84 or later on the 15 line, 16.15 or later on the 16 line, or 17.2 or later on the 17 line. Check the advisory at gov.pl for the current supported release.
- Reset the root and administrator passwords after the upgrade, and revoke active sessions.
- Look for password changes made through user accounts that should not hold that ability.
- Restrict network access to the application to the networks that need it.
- Review the two sibling CVEs for your versions.
Why it matters
The root cause is a missing authorization check. The application confirms who you are, but does not confirm that you are allowed to change the password of the account you named. This is a classic broken access control pattern: authentication is present, authorization on the specific action is not.
The impact comes from what a password change buys. Setting the root password gives the attacker that identity, with full confidentiality, integrity and availability impact, which is why a low privilege flaw scores 8.8. CERT Polska makes no statement about exploitation in the wild, and the record does not flag this CVE as a CISA Known Exploited Vulnerability.
Quick check
Do I need valid credentials to abuse CVE-2024-7265?
Yes. The vector requires a low privilege account, so the issue is mainly an insider or stolen credential risk.
Is a workaround listed?
CERT Polska lists none. The remedy is to upgrade.
Sources
Last reviewed: 19 October 2026.
