Privilege Escalation and Authentication Bypass in OpenSTAManager Software by DevCode

CVE-2026-27012

What is CVE-2026-27012?

OpenSTAManager, an open-source management software for technical assistance and invoicing, has a significant vulnerability that allows attackers to manipulate user privileges. Specifically, in versions 2.9.8 and earlier, an attacker can exploit this vulnerability by making direct calls to the 'modules/utenti/actions.php' file. This enables unauthorized changes to a user's group, allowing an existing account to be promoted to the Amministratori group or even demote any user, including administrators. As a result, this flaw poses a serious risk to the integrity of user roles and overall system security.

References