GHSA-cq7f-c253-x96pHighCVSS 8.8
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id})...
🔗 CVE IDs covered (1)
📋 Description
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-109119
- https://gitlab.com/ikus-soft/rdiffweb
- https://gitlab.com/ikus-soft/rdiffweb/-/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3
- https://gitlab.com/ikus-soft/rdiffweb/-/commit/b529adf2c13a210d10aaf56325de4d3fb2428abe
- https://github.com/advisories/GHSA-cq7f-c253-x96p