CVE-2022-26310
Improper Authorization in User Management to Vertical Privilege Escalation
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Authorization in User Management to Vertical Privilege Escalation
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
- Record
CVE-2022-26310- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2022-30871
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
- Record
EUVD-2022-30871- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9743-wggf-qgxg
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any...
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
- Record
GHSA-9743-wggf-qgxg- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
- Record
CVE-2022-26310- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-26310
Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.
- Record
UBUNTU-CVE-2022-26310- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pandorafms-agentUbuntu:16.04:LTS |
All versions, plus listed versions 4.1-1 |
None known |
pandorafms-agentUbuntu:18.04:LTS |
All versions, plus listed versions 4.1-1 |
None known |
pandorafms-agentUbuntu:20.04:LTS |
All versions, plus listed versions 4.1-1 |
None known |
pandorafms-agentUbuntu:22.04:LTS |
All versions, plus listed versions 4.1-1.1 |
None known |
pandorafms-agentUbuntu:24.04:LTS |
All versions, plus listed versions 4.1-1.1 |
None known |
pandorafms-agentUbuntu:25.10 |
All versions, plus listed versions 6.0-1 |
None known |
pandorafms-agentUbuntu:26.10 |
All versions, plus listed versions 6.0-1build16.0-2 |
None known |
pandorafms-agentUbuntu:26.04:LTS |
All versions, plus listed versions 6.0-16.0-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26310 is a high vulnerability (CVSS 7.3) in Artica Pfms Pandora Fms, published August 1, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. No source names a fixed version.