CVE-2026-41424: Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{userid} in api/api/controllers/securitycontroller.py passes request.get("user") instead of request.context['tokeninfo']['sub'] as currentuser. removenonestodict() removes the resulting None value, so the reserved-account protection in framework/wazuh/security.py cannot verify who is making the request. An authenticated user with the usersadmin role can overwrite the password of protected administrator accounts with user IDs at or below 99, including the wazuh superuser, and gain full administrative control. This issue is fixed in versions 4.10.4 and 4.14.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 4.10.4 - Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 4.14.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Wazuh user assigned the users_admin role can exploit it. The attacker can change the password of protected administrator accounts with user IDs of 99 or lower, including the wazuh superuser.
Is an unauthenticated or low-privileged network attacker affected by this flaw?
No. Exploitation requires authentication and the users_admin role; the provided information does not indicate that unauthenticated users or users without that role can trigger the password overwrite.
What is the practical impact of successful exploitation?
The attacker can overwrite a protected administrator account password and use that account to obtain full administrative control.
Which Wazuh versions should be remediated?
The issue affects versions from 4.9.0 through the affected releases before the fixes. Upgrade to 4.10.4 or 4.14.6, which are identified as fixed versions.