CVE-2026-92754: PatrowlManager through 1.8.4 Improper Access Control via users API
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated low-privilege PatrowlManager account. No user interaction is required, and the affected API endpoint is reachable over the network.
What information can be exposed?
The user listing API can disclose all users and their privilege flags, including whether accounts have superuser or staff status. The provided data does not indicate exposure of passwords or other user attributes.
Are deployments affected by default?
The issue is caused by the authorization decorator for the user listing endpoint being commented out. The provided data does not state whether any additional configuration is required for the endpoint to be available.
How can I check for exposure?
Review the users API implementation for the affected authorization decorator and determine whether low-privilege authenticated accounts can access the user listing endpoint. Inspect access logs for requests to that endpoint made by non-administrative accounts.