Privilege Escalation via Realtime Collaboration

An attacker can escalate user privileges and even gain administrative rights through the Realtime Collaboration feature. The exploitation is possible if the attacker places malicious code in their WYSIWYG editor during a Realtime Collaboration session with an administrator. The code does not need to be saved; it is executed directly in the administrator's WYSIWYG editor. The attacker can then delete the malicious code after execution, leaving no trace behind. If the target is not an administrator, the exploit can be adapted to target users with script or programming rights, resulting in a less significant but still severe impact on the system.