CVE-2026-92754
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
Faiblesse
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
Références
- https://github.com/Patrowl/PatrowlManager
- https://github.com/Patrowl/PatrowlManager/blob/1.8.4/users/apis.py#L29-L39
- https://github.com/Patrowl/PatrowlManager/issues/473
- https://www.vulncheck.com/advisories/patrowlmanager-through-1.8.4-improper-access-control-via-users-api
- https://github.com/Patrowl/PatrowlManager/issues/473
Trouvez la faille avant un attaquant.
Connectez-vous avec GitHub et lancez votre premier audit en moins d'une minute. L'offre gratuite ne nécessite aucune carte bancaire.