CVE-2026-92754

MediumCVSS 4.3/10Last modified Sep 23, 2026

Description

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Patrowl	PatrowlManager	<= 1.8.4

References

Timeline

Published: Sep 16, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-927565.5Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption se CVE-2026-927575.5Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable CVE-2026-927585.5If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in CVE-2026-927596.5SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the CVE-2026-927606.5Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscr CVE-2026-927618.8WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Att CVE-2026-927628.8Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side aut CVE-2026-927638.1Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint.CVE-2026-927644.3OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning th CVE-2026-927656.5ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vuln CVE-2026-927667.5The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in CVE-2026-927676.4The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all ve