CVE-2025-24286

A user with Backup Operator role can modify backup jobs in a way that lets them run arbitrary code on the system. This is dangerous because it allows someone with limited backup permissions to gain much broader control.

An authenticated attacker with Backup Operator privileges can manipulate backup job configurations to execute arbitrary code through improper privilege validation (CWE-269). The vulnerability requires valid authentication and the specific role assignment, but allows privilege escalation and code execution beyond the intended scope of backup operations.