CVE-2026-92754 Details
Description
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
A vulnerability exists in PatrowlManager versions through 1.8.4, where the user listing API endpoint lacks proper access controls. The authorization requirement has been disabled, allowing authenticated users with low-level privileges to access a complete list of all users. This includes sensitive information such as usernames, email addresses, and privilege indicators like superuser and staff status. The issue arises because the authorization decorator is commented out, unintentionally leaving the endpoint open to misuse.
Users can manually uncomment the authorization decorator in the 'list_users_api' function within 'users/apis.py' to restore the intended access controls.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Patrowl/PatrowlManager/issues/473 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Patrowl/PatrowlManager | [email protected] | Vendor |
| https://github.com/Patrowl/PatrowlManager/blob/1.8.4/users/apis.py#L29-L39 | [email protected] | Source CodeVendor |
| https://github.com/Patrowl/PatrowlManager/issues/473 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/patrowlmanager-through-1.8.4-improper-access-control-via-users-api | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Patrowl | All versions |
CPE
Remediation
| |
| PatrowlManager | <= 1.8.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |