What’s Vulnerable › Vulnerabilities

CVE-2026-30269

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-20 · updated 2026-06-17
• Weakness: CWE-269

Description

Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/{username}. The `role` field is accepted by the update model without a manage_users permission check for self-updates, enabling privilege escalation to high-privileged roles.

Affected products

• Doorman: 0.1.0, 1.0.2

References

• https://blog.orxiain.life/archives/cve-2026-30269---improper-access-control-in-doorman-allows-privilege-escalation
• https://github.com/apidoorman/doorman

Get alerted when CVE-2026-30269 or the next vulnerability affects your stack