CVE-2026-125382 · Other
NO FIX YET · SEE WHAT TO DO
Map-OS versions 5.0.0 through 5.2.1 let a non-administrator operator with the cUsuario permission bypass protections in the REST users API. The operator can assign the Administrador group, reset the super administrator password, or delete higher-privileged users.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Map-OS installations from 5.0.0 up to but not including 5.2.2 that have operator accounts with the cUsuario permission can reach the users API. Installations on other versions, or where no operator holds cUsuario, are not described as exposed by the sources.
Not affected if default-config
Who cares map-os, self-hosted
cUsuario permission.5.2.2 or later (from the NVD range: before 5.2.2).Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.