Cross-account printer access via unchecked badge reassignment

Missing authorization in Lexmark Cloud Services badge management allows remote authenticated users to reassign badges within an organization. The badge registration API accepts modified account and badge data from a non-administrative user without verifying authorization for the targeted user, allowing an existing badge to be bound to the attacker's account or a new badge to another user's account. A valid organization account is required; exploitation enables printer authentication as another user, release of that user's print jobs, or denial of that user's badge access.