CVE-2017-16630: Sapphireims

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

In SapphireIMS 4097_1, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Insecure Direct Object Reference (IDOR) in the local user creation function.

Affected products

• Sapphireims Sapphireims: version 4097_1 only

Published 2021-08-11. Last modified 2026-06-17.