High severity8.8NVD Advisory· Published Oct 16, 2026
CVE-2026-109119
CVE-2026-109119
Description
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.