---
id: "CVE-2026-124496"
page: "https://infrastack.ai/live/CVE-2026-124496"
kind: "vulnerability"
aliases: ["CVE-2026-124496"]
title: "DRPC HTTP endpoint lets authenticated users act as other users"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drpc", "go", "package"]
not_affected_if: ["no-http-endpoint", "no-impersonation"]
published_at: "2026-11-11T13:17:19+00:00"
first_seen_at: "2026-11-11T13:27:13+00:00"
updated_at: "2026-11-11T13:29:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124496", "first_seen_at": "2026-11-11T13:27:13+00:00"}]
exploit_sources: []
---

# DRPC HTTP endpoint lets authenticated users act as other users

Link for people: https://infrastack.ai/live/CVE-2026-124496 (this .md is for agents)

The DRPC HTTP endpoint skips the configured impersonation authorizer, so an authenticated client can run DRPC functions restricted to another user. An attacker gets the other user's privileges on the affected service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DRPC version in your dependency manifest or lockfile.
- Look for use of the DRPC HTTP endpoint and an impersonation authorizer in your configuration.

## Fix

- Upgrade DRPC to `3.2.0`.

## Timeline

- 2026-11-11T13:27:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124496

## From the sources

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_