CVE-2026-74771 in PowerProtect One
Summary
by MITRE • 08/26/2026
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The identified security flaw in Dell PowerProtect One, specifically affecting versions 20.1.0.0 and earlier, represents a critical failure in the application's authorization logic known as an Authorization Bypass Through User-Controlled Key. This vulnerability stems from improper validation of keys or identifiers that are directly supplied by the user during API requests or administrative operations. In secure software architecture, such keys should be mapped to internal session contexts or role-based permissions server-side rather than being trusted implicitly based on client input. When an application relies on a user-supplied key to determine access rights without verifying its association with the authenticated identity of the requester, it creates a pathway for privilege escalation and unauthorized data manipulation.
From a technical perspective, this flaw allows a low-privileged attacker who has already established remote network access to manipulate system behavior by injecting or altering specific keys within their requests. By controlling these keys, the attacker can trick the backend services into treating their request as if it originated from a higher-privilege account or an administrative context. This bypasses standard role-based access controls that are designed to restrict actions based on user hierarchy and permissions. The vulnerability does not require complex exploitation techniques beyond crafting specific HTTP requests with manipulated parameters, making it accessible to attackers with basic scripting capabilities who have gained initial foothold in the network perimeter.
The operational impact of this vulnerability is severe due to its potential for information tampering. Once an attacker successfully bypasses authorization controls, they can modify critical configuration settings, alter backup policies, or corrupt data integrity within the PowerProtect One environment. Since Dell PowerProtect One serves as a central platform for enterprise data protection and recovery, compromising its integrity could lead to widespread disruption of disaster recovery capabilities. Attackers might delete retention rules, change encryption keys, or inject malicious configurations that compromise future backups. This not only jeopardizes the confidentiality and availability of stored data but also undermines the trustworthiness of the entire backup infrastructure, potentially rendering restoration efforts impossible during a crisis event.
This vulnerability aligns with CWE-284, which describes Improper Access Control where insufficient access control allows an actor to act as another user or bypass security mechanisms. Furthermore, in terms of offensive cyber operations mapping, this behavior corresponds to ATT&CK technique T1078 Valid Accounts and potentially T1530 Data from Cloud Storage Object if the tampering involves modifying stored objects directly through API endpoints. The exploitation path typically falls under lateral movement or privilege escalation phases where an attacker leverages weak identity verification to expand their access scope within a compromised environment.
To mitigate this risk, organizations running affected versions of Dell PowerProtect One must immediately apply the vendor-provided security patches that address the key validation logic in the application layer. Until patching is feasible, network segmentation strategies should be enforced to restrict remote access to only essential management interfaces from trusted IP ranges. Additionally, implementing strict input validation and enforcing server-side session binding for all administrative keys can provide a compensating control against this specific bypass technique. Security teams should also monitor logs for anomalous API calls that involve unusual key manipulations or privilege changes initiated by low-privileged accounts to detect potential exploitation attempts in real time.