Administrator escalation via unchecked group assignment

Privilege escalation in dtp.ae tNexus Airport View 2.8 allows remote authenticated users to obtain administrator access. The addUser and updateUser endpoints accept crafted POST requests that assign a created or managed account to the administrator group without enforcing adequate role checks. A normal application account is required, and successful exploitation grants full administrative control over application data and settings.