{"id":"CVE-2026-109119","title":"Missing Authorization in rdiffweb","summary":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-862"],"vendor":"ikus-soft","product":"rdiffweb","affected":["rdiffweb < 2.10.6"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T10:27:28.149Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109119","references":[{"url":"https://gitlab.com/ikus-soft/rdiffweb"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/b529adf2c13a210d10aaf56325de4d3fb2428abe"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T11:04:58.138Z","slug":"CVE-2026-109119","body":"## Overview\n\nImproper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.\n\n## Affected\n\n- `rdiffweb < 2.10.6`\n\n## Remediation\n\nUpdate to v2.10.6 or higher","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}