CVE-2026-115325 — Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other network…
Published: 2026-10-22 · CVSS: 8.7 · CVSS 4.0
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7