CVE-2026-92754 — PatrowlManager through 1.8.4 Improper Access Control via users API
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated…
Published: 2026-09-16 · CVSS: 5.3 · CVSS 4.0
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7