CVE-2026-92754 in Manager
Summary
by MITRE • 09/16/2026
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The PatrowlManager software, specifically through version 1.8.4, suffers from a critical improper access control vulnerability within its user listing API endpoint. This flaw stems directly from a configuration error where the authorization decorator responsible for enforcing role-based permissions was inadvertently commented out during development or deployment. In typical web application architectures, such decorators serve as gatekeepers that validate whether an authenticated request possesses the necessary privileges to execute specific actions or view sensitive data. By removing this check, the endpoint effectively operates in an open state regarding access control logic, allowing any user who has successfully authenticated with a low-privilege account to interact with functionality intended exclusively for administrators or system operators.
From a technical perspective, this vulnerability represents a classic case of broken object level authorization where the server fails to enforce proper restrictions on how application resources can be accessed by different users. The absence of the authorization decorator means that the backend logic does not verify if the requesting user holds superuser or staff status before returning data. Consequently, an attacker with minimal privileges can send requests to this endpoint and receive a comprehensive list of all registered users along with their associated privilege flags. This includes sensitive metadata such as whether other accounts are designated as superusers or staff members, which provides attackers with valuable intelligence for further exploitation attempts.
The operational impact of this vulnerability is significant due to the information disclosure it facilitates. By enumerating user roles and privileges, an attacker can map out the administrative structure of the target system. This knowledge allows for targeted attacks against high-privilege accounts, such as attempting credential stuffing or brute-force attacks specifically on superuser accounts identified through this enumeration. Furthermore, understanding which users hold staff status may reveal internal workflows or trusted entities that could be impersonated to gain higher levels of access within the PatrowlManager environment. This undermines the fundamental security principle of least privilege and compromises the integrity of user management operations.
This vulnerability aligns with CWE-284, Improper Access Control, as it involves a failure in the application's ability to restrict actions based on user roles. Additionally, from an offensive cybersecurity framework perspective, this behavior corresponds to ATT&CK technique T1078, Valid Accounts, specifically within the context of account enumeration and privilege escalation preparation. The attacker leverages valid but low-privilege credentials to gather information that facilitates lateral movement or elevation of privileges within the system.
To mitigate this issue, immediate remediation is required by restoring the authorization decorator on the user listing API endpoint. Developers must ensure that all sensitive endpoints enforce strict role-based access control checks before processing requests and returning data. It is also recommended to implement comprehensive logging for access attempts to non-authorized resources to aid in future detection of similar misconfigurations. Regular code reviews focusing on security decorators and permission handlers can prevent such oversights from reaching production environments, ensuring that only authorized personnel with appropriate privileges can view or modify user information within the PatrowlManager application.