Vulnerability · Published Jun 23, 2026 · Assigned by VulnCheck

CVE-2026-56115Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass

High 8.8

In plain English

A high-severity missing authorization in bootimus from garybowers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	dhcpcd	no fix listed	DEBIAN-CVE-2026-56115
Debian:14	dhcpcd	no fix listed	DEBIAN-CVE-2026-56115
Ubuntu:25.10	dhcpcd	no fix listed	UBUNTU-CVE-2026-56115

Affected products (as reported)

Vendor	Product	Versions
garybowers	bootimus	0 – through 0.1.70

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/garybowers/bootimus/issues/84 technical-description, exploit
https://www.vulncheck.com/advisories/bootimus-broken-access-control-via-jwtmiddleware-authorization-bypass third-party-advisory