{"id":"CVE-2026-125360","kind":"vulnerability","aliases":["CVE-2026-125360"],"related":[],"title":"Storyden: users with role management can grant themselves administrator rights","description":"Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.","summary":"Storyden through version 1.26.16 lets a user holding the MANAGE_ROLES permission grant the ADMINISTRATOR permission without being an administrator. An attacker can add the admin role to another account they control, or create and update roles to hold admin rights, gaining full control of the instance.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"storyden","fixed":[],"affected":"<= 1.26.16","ecosystem":"github"}],"ecosystems":[],"tags":["package","self-hosted","storyden"],"not_affected_if":["no-manage-roles-users","only-admins-hold-manage-roles"],"how_to_check":"- Run Storyden version <= 1.26.16 (confirmed on v1.26.16 by the reporter) with no release containing commit bf9d872: you are affected.\n- List roles and accounts holding MANAGE_ROLES without ADMINISTRATOR (GET /roles, or Admin > Roles); any untrusted holder can promote any account to Admin via PUT /accounts/{handle}/roles/{role_id}.\n- Review recent role assignments and admin accounts for unexpected additions.","fix":"No released fix yet. Commit bf9d872 on main restricts administrator role grants to administrators; maintainer says it ships in the next release after v1.26.16. Until then, build from main at or after that commit, or remove MANAGE_ROLES from all non-admin roles.","status":"open","published_at":"2026-11-10T00:17:07+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:29:51+00:00","updated_at":"2026-11-10T00:32:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T00:29:51Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Storyden: users with role management can grant themselves administrator rights","impact":"high","summary":"Storyden through version 1.26.16 lets a user holding the MANAGE_ROLES permission grant the ADMINISTRATOR permission without being an administrator. An attacker can add the admin role to another account they control, or create and update roles to hold admin rights, gaining full control of the instance.","audience":"businesses","category":"package","nicknames":[],"who_cares":["storyden","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains full administrator control of the entire instance","analyst_note":"Confirm the fixed version and the patch in the linked github.com commit; the sources do not state a fixed release.","how_to_check":"- Check the Storyden version running on the instance; versions up to and including `1.26.16` are listed as affected.\n- Review which accounts hold the MANAGE_ROLES permission and whether any of them are untrusted.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-manage-roles-users"],"who_is_affected":"Teams that run a self-hosted Storyden instance at version 1.26.16 or earlier and have users who hold the MANAGE_ROLES permission. The sources do not say whether instances without role-management users are exposed, or how the flaw is triggered in detail.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4609,"output_tokens":533,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the patch in the linked github.com commit; the sources do not state a fixed release.","search":"'-125360':13A,16A '-2026':12A,15A '1.26.16':26B,72C 'account':52B,99C 'accountaddrol':95C 'add':46B 'admin':48B,62B 'administr':9A,37B,42B,87C,91C,107C 'allow':79C 'anoth':51B,97C 'attack':44B,92C 'call':94C 'contain':73C 'control':54B,66B,98C,111C 'creat':56B,106C 'cve':11A,14A 'escal':76C 'full':65B,110C 'gain':64B 'grant':7A,35B,85C 'hold':30B,61B,81C 'host':21B 'instanc':69B,114C 'let':27B 'manag':5A,32B,82C 'packag':18B 'permiss':34B,38B,88C 'privileg':75C 'right':10A,63B 'role':4A,33B,49B,59B,83C,108C 'rolecr':102C 'roleupd':104C 'self':20B 'self-host':19B 'storyden':1A,17A,22B,23B,70C 'take':109C 'updat':58B 'use':101C 'user':2A,29B,80C 'version':25B 'vulner':77C 'without':39B,89C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Storyden instances running 1.26.16 or earlier where a non-administrator role (e.g. community-manager or junior staff) holds MANAGE_ROLES. Such a holder can give the Admin role to another account, or create/update roles with ADMINISTRATOR, and take full control. Instances where only administrators hold MANAGE_ROLES can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T00:32:28Z","by":"analyst","doc":"https://github.com/Southclaws/storyden/commit/bf9d872179dad727f1315b409298677e77355229","run_id":2362},"who_affected":{"at":"2026-11-10T00:32:28Z","by":"analyst","doc":"https://github.com/Southclaws/storyden/commit/bf9d872179dad727f1315b409298677e77355229","run_id":2362}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["storyden"],"ptokens":["storyden"],"labels":["high","package","selfhosted","storyden"],"campaign_type":null,"search_a":"'-125360':13A,16A '-2026':12A,15A 'administr':9A 'cve':11A,14A 'grant':7A 'manag':5A 'right':10A 'role':4A 'storyden':1A,17A 'user':2A","search_b":"'1.26.16':26B 'account':52B 'add':46B 'admin':48B,62B 'administr':37B,42B 'anoth':51B 'attack':44B 'control':54B,66B 'creat':56B 'full':65B 'gain':64B 'grant':35B 'hold':30B,61B 'host':21B 'instanc':69B 'let':27B 'manag':32B 'packag':18B 'permiss':34B,38B 'right':63B 'role':33B,49B,59B 'self':20B 'self-host':19B 'storyden':22B,23B 'updat':58B 'user':29B 'version':25B 'without':39B","search_c":"'1.26.16':72C 'account':99C 'accountaddrol':95C 'administr':87C,91C,107C 'allow':79C 'anoth':97C 'attack':92C 'call':94C 'contain':73C 'control':98C,111C 'creat':106C 'escal':76C 'full':110C 'grant':85C 'hold':81C 'instanc':114C 'manag':82C 'permiss':88C 'privileg':75C 'role':83C,108C 'rolecr':102C 'roleupd':104C 'storyden':70C 'take':109C 'use':101C 'user':80C 'vulner':77C 'without':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125360","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125360","severity":null,"published_at":"2026-11-10T00:17:07+00:00","modified_at":"2026-11-10T00:17:07+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125360:2362","url":"https://github.com/Southclaws/storyden/issues/901","severity":null,"published_at":"2026-11-10T00:32:28+00:00","modified_at":"2026-11-10T00:32:28+00:00","first_seen_at":"2026-11-10T00:32:28+00:00","fetched_at":"2026-11-10T00:32:28+00:00","note":"Maintainer issue #901 (confirmed on v1.26.16) and commit bf9d872 (main, 2026-11-07, 'restrict administrator role grants to administrators'). Maintainer says fix ships in next release; no release after v1.26.16 seen on releases page, so no fixed version yet.","cites":["https://github.com/Southclaws/storyden/issues/901"]}],"documents":[{"id":111498,"url":"https://github.com/Southclaws/storyden/commit/bf9d872179dad727f1315b409298677e77355229","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111499,"url":"https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":112212,"url":"https://github.com/Southclaws/storyden/issues/901","title":"Privilege escalation: MANAGE_ROLES can grant the Admin role to other accounts","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}