CVE-2026-74032: Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resources, which omit the caller's RBAC policies, to map privileged actions and endpoints for privilege escalation planning.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Wazuh versions from 4.0.0 up to, but not including, 4.14.8 are affected.
What does an attacker need to exploit this issue?
An attacker needs an authenticated Wazuh account with low privileges and network access to query the affected security endpoints. No user interaction is required.
What information can be exposed?
A low-privileged user can read the RBAC catalog through GET /security/actions and GET /security/resources, revealing privileged actions and endpoints. The issue is limited to information disclosure; no integrity or availability impact is stated.
How can I check whether my instance is exposed?
Determine whether the Wazuh version is earlier than 4.14.8, then test whether a low-privileged authenticated account can successfully request GET /security/actions or GET /security/resources and receive RBAC catalog data.