Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92754PatrowlManager through 1.8.4 Improper Access Control via users API
Medium 4.3
In plain English
A medium-severity missing authorization in PatrowlManager from Patrowl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 72.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Patrowl | PatrowlManager | 0 – through 1.8.4 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Issue #473 issue-tracking
- https://github.com/Patrowl/PatrowlManager product
- list_users_api has its @pro_group_required decorator commented out technical-description
- VulnCheck Advisory: PatrowlManager through 1.8.4 Improper Access Control via users API third-party-advisory