CVE-2026-42185: People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation
People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42185?
CVE-2026-42185 is categorized as a privilege escalation vulnerability.
What versions are affected by CVE-2026-42185?
CVE-2026-42185 affects La Suite People versions prior to 1.25.0.
How do I fix CVE-2026-42185?
To fix CVE-2026-42185, upgrade La Suite People to version 1.25.0 or later.
What is the impact of CVE-2026-42185?
CVE-2026-42185 allows users with Administrator roles to send crafted invitation requests, potentially leading to unauthorized access.
Is there a workaround for CVE-2026-42185?
Currently, there are no documented workarounds for CVE-2026-42185; upgrading is the recommended solution.