What’s Vulnerable › Vulnerabilities

CVE-2026-109119: Missing Authorization in rdiffweb

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-16 · updated 2026-10-16
• Weakness: CWE-862

Description

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

Affected products

• ikus060/rdiffweb: before 2.10.6 — fixed in 2.10.6

How to fix

Upgrade to a fixed version: ikus060/rdiffweb 2.10.6. Check the vendor advisory for mitigations.

References

• https://gitlab.com/ikus-soft/rdiffweb
• https://gitlab.com/ikus-soft/rdiffweb/-/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3
• https://gitlab.com/ikus-soft/rdiffweb/-/commit/b529adf2c13a210d10aaf56325de4d3fb2428abe

Get alerted when CVE-2026-109119 or the next vulnerability affects your stack