---
id: "CVE-2026-109119"
kind: "vulnerability"
aliases: ["CVE-2026-109119"]
title: "Rdiffweb: authenticated users can make themselves administrators via API"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "rdiffweb", "fixed": ["2.10.6 (per CVE record, unconfirmed)", "2.11.3 (changelog: /api/users admin-only)"], "affected": "< 2.10.6 per CVE record; possibly < 2.11.3 per changelog (unconfirmed)", "ecosystem": "pypi"}]
ecosystems: []
tags: ["package", "python", "rdiffweb", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-16T11:17:00+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-24T00:29:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109119", "first_seen_at": "2026-10-23T21:57:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:29:03+00:00"}]
---

# Rdiffweb: authenticated users can make themselves administrators via API

Rdiffweb's user management endpoint /api/users/{username_or_id} does not check privileges when the role parameter changes. Any logged-in user can send a POST request that sets their own role to administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:rdiffweb affected < 2.10.6 per CVE record; possibly < 2.11.3 per changelog (unconfirmed) fixed 2.10.6 (per CVE record, unconfirmed), 2.11.3 (changelog: /api/users admin-only)

## How to check

Run 'pip show rdiffweb' (or check the package version). Treat anything below 2.11.3 as exposed; the CVE record says <2.10.6 but the changelog places the /api/users admin-only restriction in 2.11.3. Any low-privilege account on an instance can exploit it, so also check the admin list for unexpected admins.

## Fix

Upgrade rdiffweb to the latest release (at least 2.11.3, which restricts /api/users to administrators). 2.10.6 is the minimum named in the CVE record. Review admin accounts and rotate access tokens if you see unexpected admins.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109119
- 2026-10-24T00:29:03+00:00 analyst — CVE record (cve.org) says affected <2.10.6, but 2.10.6's changelog fix is the token-impersonation CVE-2025-67796, and the changelog shows 'restrict /api/users endpoint to administrators only' in 2.11.3 (2026-04-09). No vendor advisory found; range/fix version unconfirmed. Safest: upgrade to latest (>=2.11.3). No PoC or exploitation seen; X not searched.

## Documents

- [advisory] CVE Record CVE-2026-109119 https://www.cve.org/CVERecord?id=CVE-2026-109119
- [fix] rdiffweb CHANGELOG https://github.com/ikus060/rdiffweb/blob/master/CHANGELOG.md

## From the sources

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_