Privilege Escalation in Storyden Affected by Role Assignment Flaw
CVE-2026-125360

8.6HIGH

Key Information:

Vendor

SoutHCL Softwareaws

Status
Storyden
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125360?

The Storyden platform up to version 1.26.16 contains a vulnerability that allows users with the MANAGE_ROLES permission to improperly grant ADMINISTRATOR privileges. This flaw enables unauthorized users to call the AccountAddRole function on accounts they control or use RoleCreate and RoleUpdate functions to generate administrator roles, thereby gaining full control over the application instance. This presents a significant risk to account security and overall platform integrity.

Affected Version(s)

storyden 0 <= 1.26.16

References

https://github.com/Southclaws/storyden/issues/901
issue-tracking
https://github.com/Southclaws/storyden
product
https://github.com/Southclaws/storyden/blob/v1.26.16/app/...
technical-description

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.