CVE-2026-92753

Overview

PatrowlManager versions up to 1.8.4 allow authenticated users to access, delete, or modify events and alerts that belong to other users because ownership checks are missing in the API. This flaw can expose sensitive security data and disrupt incident‑response workflows.

Description

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.

Impact

Confidentiality: unauthorized reading of other users’ event history. Integrity: deletion or alteration of events and alerts that belong to other users. Availability: potential loss of critical security data, hindering incident response and audit trails.

Remediation

1. Upgrade to PatrowlManager 1.8.5 or later where the authorization checks are fixed. 2. If an upgrade is not immediately possible, restrict API access to only users who require it, enforce strict RBAC, and add explicit ownership validation in the API layer. 3. Monitor API logs for anomalous read, delete, or modify operations on events and alerts, and apply least‑privilege principles to user accounts.

Risk context

High severity (CVSS 7.1) with no EPSS data. The flaw permits authenticated attackers to compromise data confidentiality, integrity, and availability. Prompt patching or mitigation is recommended to prevent potential data leakage or tampering.

Affected products

• PatrowlManager 1.8.4
• PatrowlManager 1.8.3
• PatrowlManager 1.8.2
• PatrowlManager 1.8.1
• PatrowlManager 1.8.0