{"id":"CVE-2026-125382","kind":"vulnerability","aliases":["CVE-2026-125382"],"related":[],"title":"Map-OS: operators can escalate to administrator via users API","description":"Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users.","summary":"Map-OS versions 5.0.0 through 5.2.1 let a non-administrator operator with the cUsuario permission bypass protections in the REST users API. The operator can assign the Administrador group, reset the super administrator password, or delete higher-privileged users.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["map-os","other","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Map-OS version; unknown whether the sources name a specific command or file.\n- Look for operator accounts holding the `cUsuario` permission.","fix":"- Move Map-OS to `5.2.2` or later (from the NVD range: before `5.2.2`).","status":"open","published_at":"2026-11-10T00:17:11+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","triaged_at":"2026-11-10T00:29:50+00:00","updated_at":"2026-11-10T00:29:50+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T00:29:50Z","model":"claude-haiku-5-5","output":{"fix":"- Move Map-OS to `5.2.2` or later (from the NVD range: before `5.2.2`).","reach":"network","title":"Map-OS: operators can escalate to administrator via users API","impact":"high","summary":"Map-OS versions 5.0.0 through 5.2.1 let a non-administrator operator with the cUsuario permission bypass protections in the REST users API. The operator can assign the Administrador group, reset the super administrator password, or delete higher-privileged users.","audience":"businesses","category":"other","nicknames":[],"who_cares":["map-os","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker becomes super administrator and controls the whole application","analyst_note":"Confirm the exact affected range and the fixed version against the Map-OS patch and release notes linked from the advisory.","how_to_check":"- Check the installed Map-OS version; unknown whether the sources name a specific command or file.\n- Look for operator accounts holding the `cUsuario` permission.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Map-OS installations from 5.0.0 up to but not including 5.2.2 that have operator accounts with the cUsuario permission can reach the users API. Installations on other versions, or where no operator holds cUsuario, are not described as exposed by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4649,"output_tokens":522,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125382':14A,17A '-2026':13A,16A '/api/v1/usuarios':113C '5.0.0':29B,70C '5.2.1':31B '5.2.2':73C 'administr':8A,36B,59B,88C,102C,122C 'administrador':54B,117C 'allow':85C 'api':11A,48B,83C 'assign':52B,115C 'attack':104C 'bypass':42B,95C 'contain':74C 'cusuario':40B,92C 'cve':12A,15A 'deleg':98C 'delet':62B,110C,125C 'escal':6A,77C 'group':55B,118C 'higher':64B,127C 'higher-privileg':63B,126C 'hold':90C 'host':24B 'let':32B 'map':2A,19B,26B,68C 'map-o':1A,18B,25B,67C 'non':35B,87C 'non-administr':34B,86C 'oper':4A,37B,50B,89C 'os':3A,20B,27B,69C 'password':60B,123C 'permiss':41B,93C,97C 'permission-deleg':96C 'post':107C 'privileg':65B,76C,128C 'protect':43B,103C 'put':108C 'request':111C 'reset':56B,119C 'rest':46B,81C 'self':23B 'self-host':22B 'send':106C 'super':58B,101C,121C 'super-administr':100C 'user':10A,47B,66B,82C,129C 'version':28B 'via':9A 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Map-OS installations from 5.0.0 up to but not including 5.2.2 that have operator accounts with the cUsuario permission can reach the users API. Installations on other versions, or where no operator holds cUsuario, are not described as exposed by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","mapos","other","selfhosted"],"campaign_type":null,"search_a":"'-125382':14A,17A '-2026':13A,16A 'administr':8A 'api':11A 'cve':12A,15A 'escal':6A 'map':2A 'map-o':1A 'oper':4A 'os':3A 'user':10A 'via':9A","search_b":"'5.0.0':29B '5.2.1':31B 'administr':36B,59B 'administrador':54B 'api':48B 'assign':52B 'bypass':42B 'cusuario':40B 'delet':62B 'group':55B 'higher':64B 'higher-privileg':63B 'host':24B 'let':32B 'map':19B,26B 'map-o':18B,25B 'non':35B 'non-administr':34B 'oper':37B,50B 'os':20B,27B 'password':60B 'permiss':41B 'privileg':65B 'protect':43B 'reset':56B 'rest':46B 'self':23B 'self-host':22B 'super':58B 'user':47B,66B 'version':28B","search_c":"'/api/v1/usuarios':113C '5.0.0':70C '5.2.2':73C 'administr':88C,102C,122C 'administrador':117C 'allow':85C 'api':83C 'assign':115C 'attack':104C 'bypass':95C 'contain':74C 'cusuario':92C 'deleg':98C 'delet':110C,125C 'escal':77C 'group':118C 'higher':127C 'higher-privileg':126C 'hold':90C 'map':68C 'map-o':67C 'non':87C 'non-administr':86C 'oper':89C 'os':69C 'password':123C 'permiss':93C,97C 'permission-deleg':96C 'post':107C 'privileg':76C,128C 'protect':103C 'put':108C 'request':111C 'reset':119C 'rest':81C 'send':106C 'super':101C,121C 'super-administr':100C 'user':82C,129C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125382","severity":null,"published_at":"2026-11-10T00:17:11+00:00","modified_at":"2026-11-10T00:17:11+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","fetched_at":"2026-11-10T00:28:43+00:00","note":null}],"documents":[{"id":111547,"url":"https://github.com/RamonSilva20/mapos/commit/9a4c5dc3835b52c12616a73ab60635e96e23ad7a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111548,"url":"https://github.com/RamonSilva20/mapos/releases/tag/v5.2.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111549,"url":"https://www.vulncheck.com/advisories/map-os-5.0.0-to-before-5.2.2-privilege-escalation-via-api-v1-usuarios","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}