Live › vulnerability › CVE-2026-109119
Go to dashboardRdiffweb's user management endpoint /api/users/{username_or_id} does not check privileges when the role parameter changes. Any logged-in user can send a POST request that sets their own role to administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| rdiffweb | pypi | < 2.10.6 per CVE record; possibly < 2.11.3 per changelog (unconfirmed) | 2.10.6 (per CVE record, unconfirmed), 2.11.3 (changelog: /api/users admin-only) |
pip show rdiffweb (or check the package version)2.11.3 as exposed; the CVE record says <2.10.6 but the changelog places the /api/users admin-only restriction in 2.11.32.11.3, which restricts /api/users to administrators). 2.10.6 is the minimum named in the CVE recordEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
This page as .md · .json · in your agent: get_signal("CVE-2026-109119")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.