{"id":"CVE-2026-124496","kind":"vulnerability","aliases":["CVE-2026-124496"],"related":[],"title":"DRPC HTTP endpoint lets authenticated users act as other users","description":"The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.","summary":"The DRPC HTTP endpoint skips the configured impersonation authorizer, so an authenticated client can run DRPC functions restricted to another user. An attacker gets the other user's privileges on the affected service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drpc","go","package"],"not_affected_if":["no-http-endpoint","no-impersonation"],"how_to_check":"- Check the installed DRPC version in your dependency manifest or lockfile.\n- Look for use of the DRPC HTTP endpoint and an impersonation authorizer in your configuration.","fix":"- Upgrade DRPC to `3.2.0`.","status":"open","published_at":"2026-11-11T13:17:19+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:59+00:00","updated_at":"2026-11-11T13:29:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T13:29:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade DRPC to `3.2.0`.","reach":"network","title":"DRPC HTTP endpoint lets authenticated users act as other users","impact":"medium","summary":"The DRPC HTTP endpoint skips the configured impersonation authorizer, so an authenticated client can run DRPC functions restricted to another user. An attacker gets the other user's privileges on the affected service.","audience":"developers","category":"package","nicknames":[],"who_cares":["drpc","go"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated attacker runs functions restricted to other users","analyst_note":"Confirm the affected DRPC package name and ecosystem from the NVD entry and check whether the impersonation authorizer is bypassed only when it is configured.","how_to_check":"- Check the installed DRPC version in your dependency manifest or lockfile.\n- Look for use of the DRPC HTTP endpoint and an impersonation authorizer in your configuration.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-http-endpoint","no-impersonation"],"who_is_affected":"Applications that use the DRPC HTTP endpoint with user impersonation configured are exposed to authenticated users acting as others. Applications that do not expose the DRPC HTTP endpoint or do not use impersonation are likely unaffected, though the sources do not say this explicitly.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4532,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124496':13A,16A '-2026':12A,15A '3.2.0':91C 'act':7A,61C 'affect':51B 'anoth':39B,63C,82C 'appli':66C 'attack':42B 'authent':5A,31B,59C,72C 'author':28B,70C 'client':32B,60C 'configur':26B,68C 'cve':11A,14A 'drpc':1A,17B,21B,35B,54C,76C 'endpoint':3A,23B,56C 'execut':75C 'fix':93C 'function':36B,77C 'get':43B 'go':18B 'http':2A,22B,55C 'imperson':27B,69C 'issu':95C 'let':4A,57C 'packag':19B 'privileg':48B 'recommend':86C 'restrict':37B,80C 'run':34B 'servic':52B 'skip':24B 'upgrad':88C 'user':6A,10A,40B,46B,64C,73C,83C,84C 'version':90C 'without':65C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the DRPC HTTP endpoint with user impersonation configured are exposed to authenticated users acting as others. Applications that do not expose the DRPC HTTP endpoint or do not use impersonation are likely unaffected, though the sources do not say this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["drpc","go","high","package"],"campaign_type":null,"search_a":"'-124496':13A,16A '-2026':12A,15A 'act':7A 'authent':5A 'cve':11A,14A 'drpc':1A 'endpoint':3A 'http':2A 'let':4A 'user':6A,10A","search_b":"'affect':51B 'anoth':39B 'attack':42B 'authent':31B 'author':28B 'client':32B 'configur':26B 'drpc':17B,21B,35B 'endpoint':23B 'function':36B 'get':43B 'go':18B 'http':22B 'imperson':27B 'packag':19B 'privileg':48B 'restrict':37B 'run':34B 'servic':52B 'skip':24B 'user':40B,46B","search_c":"'3.2.0':91C 'act':61C 'anoth':63C,82C 'appli':66C 'authent':59C,72C 'author':70C 'client':60C 'configur':68C 'drpc':54C,76C 'endpoint':56C 'execut':75C 'fix':93C 'function':77C 'http':55C 'imperson':69C 'issu':95C 'let':57C 'recommend':86C 'restrict':80C 'upgrad':88C 'user':64C,73C,83C,84C 'version':90C 'without':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124496","severity":null,"published_at":"2026-11-11T13:17:19+00:00","modified_at":"2026-11-11T13:17:19+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}