high · CVSS v3 7.2 · CVSS v4 8.6

CVE-2026-125382

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-adminis…

Description

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users.

Scores

Severity
high
CVSS v2
8.3
CVSS v3
7.2
CVSS v4
8.6
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-125074

A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.

View analysis

high

CVE-2026-125076

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

View analysis

high

CVE-2026-125078

A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

View analysis

high

CVE-2026-125360

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.

View analysis