Vulnerability Description
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Patrowl/PatrowlManager
- https://github.com/Patrowl/PatrowlManager/blob/1.8.4/users/apis.py#L29-L39
- https://github.com/Patrowl/PatrowlManager/issues/473
- https://www.vulncheck.com/advisories/patrowlmanager-through-1.8.4-improper-acces
- https://github.com/Patrowl/PatrowlManager/issues/473
FAQ
What is CVE-2026-92754?
CVE-2026-92754 is a vulnerability with a CVSS score of 4.3 (MEDIUM). PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-pri...
How severe is CVE-2026-92754?
CVE-2026-92754 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92754?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.