CVE-2025-10352: Melis Platform CMS Unauthenticated Admin Account Creation

The vulnerability lies in the melis-core module of the Melis Platform, specifically within the ToolUserController. The core issue is a missing authorization check across multiple functions responsible for user management. The vulnerability allows an unauthenticated attacker to perform administrative actions such as creating, deleting, and updating user accounts. The provided commit e938dd14e108b921e6a399b35976dfb429c41df5 clearly shows the addition of access control checks at the beginning of the addNewUserAction, deleteUserAction, and updateUserInfoAction functions in src/Controller/ToolUserController.php. Before this patch, these functions were publicly accessible, leading to the described unauthenticated account creation vulnerability. The vulnerable functions are MelisCore\Controller\ToolUserController::addNewUserAction, MelisCore\Controller\ToolUserController::deleteUserAction, and MelisCore\Controller\ToolUserController::updateUserInfoAction. An attacker exploiting this vulnerability would cause these functions to appear in a runtime profile or stack trace.