{"id":"CVE-2026-109119","published":"2026-10-16T11:17:00.927","lastModified":"2026-10-16T20:04:29.760","description":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.com/ikus-soft/rdiffweb","tags":[]},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3","tags":[]},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/b529adf2c13a210d10aaf56325de4d3fb2428abe","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}