RF455-114 Critical Security Vulnerability: Regular Player Accounts Can Execute GM Commands

Regular player accounts can execute multiple Game Master (GM) commands that provide unrestricted access to administrative functions and gameplay manipulation. This issue allows ordinary players to modify character attributes, gain invulnerability, bypass progression systems, and manipulate combat and item enhancement mechanics without having any GM privileges.

The affected accounts do not have any administrative permission level above 0, yet these commands execute successfully.

Confirmed Affected Commands: %goldpoint — Sets the character's Gold Points to a specified amount without requiring the completion of quests, use of potions, or other legitimate methods of obtaining them. %neverdie — Makes the character invulnerable, even though the account has no GM permission level above 0. %matchless — Allows the character to kill any monster in a single hit, regardless of equipment or other character attributes. %godhand — Guarantees a 100% success rate when upgrading weapons, armor, and other equipment. %beggar — Causes targets to drop all possible loot. %pass quest — Automatically marks the nearest quest as completed. %allskills — Maximizes all PT (Proficiency), skills, and magic levels. %money — Sets the character's race-specific currency to the maximum amount. %gold — Sets the character's Platinum currency to the maximum amount. %lv [level] — Sets the character's level to the specified value. %town — Teleports the character to their race's headquarters. These are only some of the confirmed examples; other GM commands may also be accessible.

Actual Behavior: Regular player accounts with an administrative permission level of 0 can execute commands normally reserved for Game Masters. These commands successfully perform their associated actions without requiring GM privileges.

Expected Behavior: All GM commands must be restricted to accounts with the appropriate administrative permissions. The server must validate the player's authorization level before executing each command and reject unauthorized requests from regular player accounts. Severity: Critical — Security vulnerability / Privilege escalation

Additional Notes: This issue strongly suggests that GM command authorization is either missing, incorrectly implemented, or insufficiently enforced on the server side. Since the commands successfully modify server-side character data and gameplay behavior, this is not merely a client-side display issue.