{"id":"CVE-2026-109119","kind":"vulnerability","aliases":["CVE-2026-109119"],"related":[],"title":"Rdiffweb: authenticated users can make themselves administrators via API","description":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","summary":"Rdiffweb's user management endpoint /api/users/{username_or_id} does not check privileges when the role parameter changes. Any logged-in user can send a POST request that sets their own role to administrator.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rdiffweb","fixed":["2.10.6 (per CVE record, unconfirmed)","2.11.3 (changelog: /api/users admin-only)"],"affected":"< 2.10.6 per CVE record; possibly < 2.11.3 per changelog (unconfirmed)","ecosystem":"pypi"}],"ecosystems":[],"tags":["package","python","rdiffweb","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"Run 'pip show rdiffweb' (or check the package version). Treat anything below 2.11.3 as exposed; the CVE record says <2.10.6 but the changelog places the /api/users admin-only restriction in 2.11.3. Any low-privilege account on an instance can exploit it, so also check the admin list for unexpected admins.","fix":"Upgrade rdiffweb to the latest release (at least 2.11.3, which restricts /api/users to administrators). 2.10.6 is the minimum named in the CVE record. Review admin accounts and rotate access tokens if you see unexpected admins.","status":"open","published_at":"2026-10-16T11:17:00+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:34:52+00:00","updated_at":"2026-10-24T00:29:03+00:00","category":"package","confidence":0.55,"triage":{"at":"2026-10-23T22:34:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Rdiffweb: authenticated users can make themselves administrators via API","impact":"high","summary":"Rdiffweb's user management endpoint /api/users/{username_or_id} does not check privileges when the role parameter changes. Any logged-in user can send a POST request that sets their own role to administrator.","category":"package","who_cares":["rdiffweb","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"A regular user becomes administrator and gains control of all backups","analyst_note":"Find the fixed Rdiffweb version and affected version range in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109119 and in the Rdiffweb release notes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000459,"input_tokens":2890,"output_tokens":339,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Rdiffweb version and affected version range in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109119 and in the Rdiffweb release notes.","search":"'-109119':12A,15A '-2026':11A,14A '/api/users':28B,67C 'administr':7A,57B,81C 'allow':73C 'api':9A,65C 'authent':2A,74C 'chang':40B 'check':34B 'cve':10A,13A 'elev':77C 'endpoint':27B,66C 'host':22B 'id':31B,70C 'improp':58C 'log':43B 'logged-in':42B 'make':5A 'manag':26B,60C,64C 'modifi':83C 'packag':17B 'paramet':39B,86C 'post':49B,89C 'privileg':35B,59C,79C 'python':18B 'rdiffweb':1A,16A,19B,23B,72C 'request':50B,90C 'role':38B,55B,85C 'self':21B 'self-host':20B 'send':47B 'set':52B 'user':3A,25B,45B,63C,75C 'usernam':29B,68C 'via':8A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T11:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109119","severity":null,"published_at":"2026-10-16T11:17:00+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109119:669","url":null,"severity":null,"published_at":"2026-10-24T00:29:03+00:00","modified_at":"2026-10-24T00:29:03+00:00","first_seen_at":"2026-10-24T00:29:03+00:00","fetched_at":"2026-10-24T00:29:03+00:00","note":"CVE record (cve.org) says affected <2.10.6, but 2.10.6's changelog fix is the token-impersonation CVE-2025-67796, and the changelog shows 'restrict /api/users endpoint to administrators only' in 2.11.3 (2026-04-09). No vendor advisory found; range/fix version unconfirmed. Safest: upgrade to latest (>=2.11.3). No PoC or exploitation seen; X not searched."}],"documents":[{"id":2637,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109119","title":"CVE Record CVE-2026-109119","kind":"advisory","source":"analyst","text":"Improper Privilege Management in /api/users/{username_or_id} in Rdiffweb: authenticated users can elevate to administrator via role parameter in POST. CWE-862, CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:N. Affected: from 0 before 2.10.6.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2636,"url":"https://github.com/ikus060/rdiffweb/blob/master/CHANGELOG.md","title":"rdiffweb CHANGELOG","kind":"release","source":"analyst","text":"2.11.3 - 2026-04-09: 'api: restrict /api/users endpoint to administrators only (b4ad4db)'. Earlier: 2.11.0 'API now accepts role names in POST /api/users (#341)'. 2.10.6 (2025-10-02): security fix for token impersonation (CVE-2025-67796).","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}