CVE-2026-109119
8.8HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-862
Impact
Authenticated low-privilege users can gain full administrator privileges. They need network access to Rdiffweb and valid user credentials to send a modified POST request.
Root cause
The /api/users/{username_or_id} endpoint lacks authorization checks on the role parameter, allowing users to reassign their own role.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Pull the latest changes from the upstream Git repository containing commits 4ce35fc and b529adf, or restrict user access to the Rdiffweb web interface until patched.
$ pip install --upgrade rdiffwebAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.