Authenticated Administrator access via attachment authorization failure

Permission failure in Dreamer CMS 4.1.0 through 4.1.3 allows remote authenticated users to obtain Administrator access via attachments. The public record identifies the Attachment Handler and reports that ordinary accounts gain administrator rights, but it does not disclose the endpoint or failed authorization check. A valid low-privileged account and network access to the administrative interface are required; successful exploitation crosses the application's administrator boundary.