CVE-2026-92754

MEDIUM 4.3

PatrowlManager through 1.8.4 Improper Access Control via users API

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.

CWE	CWE-862
Vendor	patrowl
Product	patrowlmanager
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for patrowl patrowlmanager

Be the first to know when new medium vulnerabilities affecting patrowl patrowlmanager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Patrowl / PatrowlManager

0 ≤ 1.8.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Patrowl/PatrowlManager/issues/473 github.com: https://github.com/Patrowl/PatrowlManager github.com: https://github.com/Patrowl/PatrowlManager/blob/1.8.4/users/apis.py#L29-L39 vulncheck.com: https://www.vulncheck.com/advisories/patrowlmanager-through-1.8.4-improper-access-control-via-users-api

Credits

George Chen