CVE-2026-109119: Missing Authorization in rdiffweb
Improper Privilege Management in the user management API endpoint (/api/users/{usernameorid}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rdiffwebto a version that resolves this vulnerability.Fixed in 2.10.6
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already be authenticated with a low-privileged account. No user interaction is required, and the attack can be performed remotely over the network.
What is the impact after successful exploitation?
An authenticated attacker can change the role parameter in a POST request to the user-management API and elevate their account to administrator. The reported impact includes high confidentiality, integrity, and availability impact.
Which interface should defenders prioritize for investigation and mitigation?
Prioritize the user-management API endpoint at /api/users/{username_or_id}, specifically POST requests that modify the role parameter. Review whether non-administrative accounts have made role-changing requests or now possess administrator privileges.