Improper Privilege Management in Rdiffweb by Ikus-Soft

CVE-2026-109119

What is CVE-2026-109119?

In Rdiffweb, a flaw exists in the user management API endpoint (/api/users/{username_or_id}) that allows authenticated users to elevate their privileges to administrator status. This is accomplished by manipulating the role parameter in a POST request, which can lead to unauthorized access and potential misuse of administrative capabilities. This vulnerability underscores the importance of secure parameter validation in API endpoints to prevent privilege escalation.

References