CVE-2026-109119

CVE-2026-109119 · Missing Authorization in rdiffweb

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

CVSS 8.8 · High · EPSS 0.4% · Fix available

Published: 2026-10-16T10:27:28.149Z
Updated: 2026-10-16T13:31:33.847Z

Affected products and versions

rdiffweb
Versions
- ≥ 0, < 2.10.6: Affected (semver)
Update to 2.10.6

Original sources

https://gitlab.com/ikus-soft/rdiffweb
https://gitlab.com/ikus-soft/rdiffweb/-/commit/b529adf2c13a210d10aaf56325de4d3fb2428abe
https://gitlab.com/ikus-soft/rdiffweb/-/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3
https://nvd.nist.gov/vuln/detail/CVE-2026-109119

Check your server →