CVE-2026-92753

7.1 Élevée

Publiée le 16/09/2026 à 23:17 · Modifiée le 23/09/2026 à 19:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.

Traduire en français

Produits concernés

PatrowlManager

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.1 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/Patrowl/PatrowlManager
https://github.com/Patrowl/PatrowlManager/blob/1.8.4/events/apis.py#L15-L60
https://github.com/Patrowl/PatrowlManager/issues/474
https://www.vulncheck.com/advisories/patrowlmanager-through-1.8.4-authorization-bypass-via-events-api
https://github.com/Patrowl/PatrowlManager/issues/474

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories