suitenumerique people up to 1.24.x privileges management

Summaryinfo

A vulnerability, which was classified as critical, was found in suitenumerique people up to 1.24.x. The impacted element is an unknown function. Such manipulation leads to privileges management. This vulnerability is documented as CVE-2026-42185. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in suitenumerique people up to 1.24.x and classified as critical. Affected by this issue is some unknown functionality. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-42185 since 04/25/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.25.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• suitenumerique

Name

• people

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24

Website

• Product: https://github.com/suitenumerique/people/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion