{"id":"CVE-2026-109119","aliases":["EUVD-2026-102836","GHSA-cq7f-c253-x96p"],"status":"published","title":"Missing Authorization in rdiffweb","description":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0038,"percentile":0.32432,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-16T10:27:28Z","modified":"2026-10-28T02:30:23Z","products":[{"vendor":"ikus-soft","product":"rdiffweb"}],"references":[{"url":"https://gitlab.com/ikus-soft/rdiffweb","tags":["package"]},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/b529adf2c13a210d10aaf56325de4d3fb2428abe","tags":["fix"]},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109119","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cq7f-c253-x96p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109119.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-109119","title":"Missing Authorization in rdiffweb","description":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","status":"published","published":"2026-10-16T10:27:28.149Z","modified":"2026-10-16T13:31:33.847Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:11.581788Z"}],"euvd":[{"id":"EUVD-2026-102836","description":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","status":"published","published":"2026-10-16T10:27:28Z","modified":"2026-10-16T13:31:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:06.126239Z"}],"ghsa":[{"id":"GHSA-cq7f-c253-x96p","title":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id})...","description":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","status":"published","published":"2026-10-16T12:31:22Z","modified":"2026-10-16T12:31:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:13:51.12467Z"}],"nvd":[{"id":"CVE-2026-109119","description":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","status":"published","published":"2026-10-16T11:17:00.927Z","modified":"2026-10-16T20:04:29.76Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-109119","title":"Missing Authorization in rdiffweb","description":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","status":"published","published":"2026-10-16T10:27:28.149Z","modified":"2026-10-28T02:30:23.165800556Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:55.279797Z"}]}}