Privilege Escalation Vulnerability in UpSnap Wake on LAN Web App

CVE-2026-49819

What is CVE-2026-49819?

The UpSnap Wake on LAN web app contains a significant security flaw that allows network-adjacent attackers to exploit a privilege escalation vulnerability. The issue arises from the lack of authentication in the pb.HandlerInitSuperuser endpoint, which is accessible via POST /api/upsnap/init-superuser. This endpoint's security relies solely on a count check of totalSuperusers, which is typically set to zero on a fresh installation. As a result, an unauthenticated user could register a superuser account, subsequently obtaining a long-lived JSON Web Token (JWT). This access could lead to unauthorized root remote code execution through subsequent commands. The issue has been resolved in version 5.4.0 of the application.

References