CVE-2026-44846 in JumpServer
Summary
by MITRE • 08/17/2026
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member's existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
JumpServer serves as a critical open-source bastion host and operational security audit system designed to manage access control for IT infrastructure. The vulnerability identified within versions prior to 4.10.17 resides specifically in the user invitation logic located in the application module apps/users/api/user.py. This flaw is triggered when an authenticated user possessing only the users.invite_user permission submits a POST request to the endpoint /api/v1/users/users/invite/. The core technical deficiency lies in how the backend processes this specific API call, where it fails to adequately validate whether the target member already exists within the organization or if they are being added for the first time.
When an existing member is included in the invitation payload, the system executes a direct assignment operation on the user's organizational roles via the set method, specifically user.org_roles.set(org_roles). This implementation flaw results in the complete replacement of the target user's existing organization roles rather than merging or appending new permissions to their current profile. Consequently, any pre-existing role assignments are overwritten by the values provided in the invitation request. This behavior creates a significant security gap because it allows users with relatively low-level privileges to manipulate the permission structures of other accounts within the same organization.
The operational impact of this vulnerability is severe due to its potential for both privilege escalation and unauthorized de-privileging. An attacker or malicious insider could exploit this logic by inviting an administrator back into a group, thereby stripping them of their elevated roles if they do not explicitly include those high-level permissions in the invitation payload. Conversely, if the attacker controls the org_roles data sent in the request, they can assign themselves or other compromised accounts administrative privileges that were previously restricted. This undermines the principle of least privilege and compromises the integrity of the access control model maintained by JumpServer for auditing and security compliance purposes.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it allows an actor to elevate or reduce their own or others' privileges without proper authorization checks. It also relates to CWE-862, Missing Authorization, because the system fails to verify if the user performing the action has the right to modify the specific role assignments of existing members in this manner. In terms of adversary tactics, this flaw facilitates lateral movement and privilege escalation within a compromised environment, mapping closely to MITRE ATT&CK techniques such as T1078 Valid Accounts for maintaining access and potentially T1548 Abuse Elevation Control Mechanism if used to bypass role-based restrictions.
To mitigate this risk, organizations running JumpServer must immediately upgrade to version 4.10.17 or later, where the invitation logic has been corrected to handle existing members appropriately without overwriting their current roles unless explicitly intended by an administrator with higher privileges. Until the patch is applied, administrators should restrict the users.invite_user permission strictly to trusted personnel and monitor audit logs for unusual patterns of user invitations that involve re-inviting existing accounts or frequent changes in role assignments. Additionally implementing strict input validation on the backend to distinguish between new member additions and updates to existing members can provide a temporary defensive layer against this specific exploitation vector.