CVE-2026-109119 PUBLISHED

Missing Authorization in rdiffweb

Assigner: GitLab
Reserved: 12.10.2026 Published: 16.10.2026 Updated: 16.10.2026

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	ikus-soft
Product	rdiffweb
Versions	Default: unknown affected from 0 to 2.10.6 (excl.)

Solutions

Update to v2.10.6 or higher

Credits

sagar banwa <sagarbanwa1337@gmail.com> finder

References

https://gitlab.com/ikus-soft/rdiffweb
https://gitlab.com/ikus-soft/rdiffweb/-/commit/b529adf2c13a210d10aaf56325de4d3fb2428abe
https://gitlab.com/ikus-soft/rdiffweb/-/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3

Problem Types

CWE-862: Missing Authorization CWE