---
id: "CVE-2026-125360"
page: "https://infrastack.ai/live/CVE-2026-125360"
kind: "vulnerability"
aliases: ["CVE-2026-125360"]
title: "Storyden: users with role management can grant themselves administrator rights"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "storyden", "fixed": [], "affected": "<= 1.26.16", "ecosystem": "github"}]
ecosystems: []
tags: ["package", "self-hosted", "storyden"]
not_affected_if: ["no-manage-roles-users", "only-admins-hold-manage-roles"]
published_at: "2026-11-10T00:17:07+00:00"
first_seen_at: "2026-11-10T00:28:42+00:00"
updated_at: "2026-11-10T00:32:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125360", "first_seen_at": "2026-11-10T00:28:42+00:00"}, {"source": "analyst", "url": "https://github.com/Southclaws/storyden/issues/901", "first_seen_at": "2026-11-10T00:32:28+00:00", "cites": ["https://github.com/Southclaws/storyden/issues/901"]}]
exploit_sources: []
---

# Storyden: users with role management can grant themselves administrator rights

Link for people: https://infrastack.ai/live/CVE-2026-125360 (this .md is for agents)

Storyden through version 1.26.16 lets a user holding the MANAGE_ROLES permission grant the ADMINISTRATOR permission without being an administrator. An attacker can add the admin role to another account they control, or create and update roles to hold admin rights, gaining full control of the instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:storyden affected <= 1.26.16 fixed no fixed version listed

## How to check

- Run Storyden version <= 1.26.16 (confirmed on v1.26.16 by the reporter) with no release containing commit bf9d872: you are affected.
- List roles and accounts holding MANAGE_ROLES without ADMINISTRATOR (GET /roles, or Admin > Roles); any untrusted holder can promote any account to Admin via PUT /accounts/{handle}/roles/{role_id}.
- Review recent role assignments and admin accounts for unexpected additions.

## Fix

No released fix yet. Commit bf9d872 on main restricts administrator role grants to administrators; maintainer says it ships in the next release after v1.26.16. Until then, build from main at or after that commit, or remove MANAGE_ROLES from all non-admin roles.

## Timeline

- 2026-11-10T00:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125360
- 2026-11-10T00:32:28+00:00 analyst https://github.com/Southclaws/storyden/issues/901 — Maintainer issue #901 (confirmed on v1.26.16) and commit bf9d872 (main, 2026-11-07, 'restrict administrator role grants to administrators'). Maintainer says fix ships in next release; no release after v1.26.16 seen on releases page, so no fixed version yet.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment
- [advisory] Privilege escalation: MANAGE_ROLES can grant the Admin role to other accounts https://github.com/Southclaws/storyden/issues/901
- [fix] Patch: github.com https://github.com/Southclaws/storyden/commit/bf9d872179dad727f1315b409298677e77355229

## From the sources

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_