CVE-2026-92754
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
Risk Assessment
Enumeration of users and their privileges may help attackers plan further attacks, such as privilege escalation or targeted attacks.
Recommendation
Upgrade PatrowlManager beyond version 1.8.4 or restore the authorization decorator in the user listing endpoint.
Other vulnerabilities in PatrowlManager
Original NVD description (English source)
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS