Vulnerability · Published Sep 20, 2026 · Assigned by VulDB

CVE-2026-93968aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management

Low 3.8

In plain English

A low-severity privilege mismanagement in SxDevOps from aiyiyi121. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected products (as reported)

Vendor	Product	Versions
aiyiyi121	SxDevOps	1.01.1

Weakness: CWE-269, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C

References

VDB-407927 | aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management vdb-entry, technical-description
VDB-407927 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-93968 | CVE Analysis and Report third-party-advisory
Submit #944383 | aiyiyi121 SxDevOps 1.1 Privilege Escalation third-party-advisory
https://github.com/aiyiyi121/sxdevops/issues/16 issue-tracking
https://github.com/aiyiyi121/sxdevops/commit/2b4bf8585c3e731e7a8af30801ea46680bc783f9 patch
https://github.com/aiyiyi121/sxdevops/ product