CVE-2026-125360
Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.
| CWE | CWE-269 |
| Vendor | southclaws |
| Product | storyden |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for southclaws storyden
Be the first to know when new high vulnerabilities affecting southclaws storyden are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Southclaws / storyden
0 ≤ 1.26.16
References
github.com: https://github.com/Southclaws/storyden/issues/901 github.com: https://github.com/Southclaws/storyden github.com: https://github.com/Southclaws/storyden/blob/v1.26.16/app/transports/http/bindings/accounts.go#L703-L713 github.com: https://github.com/Southclaws/storyden/commit/bf9d872179dad727f1315b409298677e77355229 vulncheck.com: https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment
Credits
George Chen