CVE-2026-49819
CriticalCVSS 9.8Summary
UpSnap, a wake on lan web app, versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser. An unauthenticated network-adjacent attacker can register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution.
Risk Assessment
An attacker could gain full control of the system, potentially leading to data theft, service disruption, and further network attacks.
Recommendation
Update UpSnap to version 5.4.0 or later, which fixes this vulnerability.
Original NVD description (English source)
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.