CVE-2026-125360: Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment
Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGEROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who holds the MANAGE_ROLES permission can exploit it. The attacker does not need to already be an administrator.
What access does an attacker need before exploitation?
The attacker needs an account with MANAGE_ROLES and must be able to act on another account they control, or be able to create or update roles. They can use AccountAddRole to assign an administrator-capable role, or use RoleCreate or RoleUpdate to create such a role.
What is the likely impact after successful exploitation?
An attacker can grant the ADMINISTRATOR permission and obtain full control of the Storyden instance.
Which versions are known to be affected?
Storyden through version 1.26.16 is affected.