CVE-2026-125382: Map-OS 5.0.0 to before 5.2.2 Privilege Escalation via /api/v1/usuarios
Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Any non-administrator operator account that holds the cUsuario permission can exploit it. The issue does not require administrator privileges or user interaction.
What access does an attacker need?
An attacker needs network access to the Map-OS REST API and valid credentials for an operator account with the cUsuario permission. They can then submit POST, PUT, or DELETE requests to /api/v1/usuarios.
What could an attacker do after exploiting it?
They can assign themselves or another account to the Administrador group, reset the super administrator password, or delete users with higher privileges.
Which versions are affected?
Map-OS versions 5.0.0 through versions before 5.2.2 are affected. Version 5.2.2 is not included in the affected range.