CVE-2026-50770
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
An issue in Squirro Cognitive Search before version 3.14.2 allows a remote attacker to escalate privileges via a crafted request. This vulnerability enables unauthorized elevation of access levels.
Risk Assessment
An attacker can gain higher privileges in the system, potentially leading to unauthorized access to sensitive data or full control over the application.
Recommendation
Update Squirro Cognitive Search to version 3.14.2 or later. Conduct a privilege audit and restrict user roles to the minimum necessary.
Other vulnerabilities in Squirro Cognitive Search
See all- CVE-2026-50772Critical
An issue in Squirro Cognitive Search versions prior to 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload sent to the password reset function. The vulnerability can be exploited to take control of the application.
- CVE-2026-50771Medium
Squirro Cognitive Search before 3.14.2 has a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to execute arbitrary code via the Email Notification, Create Evaluation Sets and HTML Editor functions.
Original NVD description (English source)
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS