CVE-2026-92753

HIGH 7.1

PatrowlManager through 1.8.4 Authorization Bypass via Events API

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.

CWE	CWE-862
Vendor	patrowl
Product	patrowlmanager
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for patrowl patrowlmanager

Be the first to know when new high vulnerabilities affecting patrowl patrowlmanager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

Patrowl / PatrowlManager

0 ≤ 1.8.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Patrowl/PatrowlManager/issues/474 github.com: https://github.com/Patrowl/PatrowlManager github.com: https://github.com/Patrowl/PatrowlManager/blob/1.8.4/events/apis.py#L15-L60 vulncheck.com: https://www.vulncheck.com/advisories/patrowlmanager-through-1.8.4-authorization-bypass-via-events-api

Credits

George Chen