Privilege Escalation Vulnerability in Map-OS by Ramon Silva

CVE-2026-125382

What is CVE-2026-125382?

Map-OS versions prior to 5.2.2 possess a vulnerability in the REST users API. This weakness allows operators with the cUsuario permission to circumvent established permission-delegation and super-administrator safeguards. Attackers can exploit this flaw by sending unauthorized POST, PUT, or DELETE requests to the /api/v1/usuarios endpoint. Such requests could lead to the unauthorized assignment of the Administrador group, potential resetting of super-administrator passwords, or even deletion of privileged users. Users of Map-OS are advised to upgrade to the latest version to mitigate this security risk.

References