CVE-2026-92753

HighCVSS 7.1

Published: 16/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.

Risk Assessment

An attacker can compromise the confidentiality and integrity of other users' data and erase traces of security incidents, hindering detection of malicious activity.

Recommendation

Upgrade PatrowlManager beyond 1.8.4 and ensure the events and alerts API endpoints enforce ownership filtering.

Other vulnerabilities in PatrowlManager

CVE-2026-92754Medium
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS