CVE-2026-109119

HighCVSS 8.8

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

Risk Assessment

A low-privileged attacker can gain full administrative control over the system, leading to unauthorized access and data modification.

Recommendation

Update Rdiffweb to a patched version and enforce server-side permission checks for role change operations.

Other vulnerabilities in Rdiffweb

CVE-2026-109118Medium
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause browse, restore, history, and delete operations to resolve to a path outside the repository, via a percent-encoded traversal sequence (%2e%2e) in the request path. The issue arises because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user must already have permissions on it.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS