CVE-2026-41424

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41424

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41424.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41424

Aliases

GHSA-gj9h-8hmr-xjjr

Published

2026-08-19T16:18:24Z

Modified

2026-08-23T03:42:31Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H CVSS Calculator

Summary

Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint

Details

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api/controllers/security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user. remove_nones_to_dict() removes the resulting None value, so the reserved-account protection in framework/wazuh/security.py cannot verify who is making the request. An authenticated user with the users_admin role can overwrite the password of protected administrator accounts with user IDs at or below 99, including the wazuh superuser, and gain full administrative control. This issue is fixed in versions 4.10.4 and 4.14.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41424.json"
}

References

Affected packages

Git / github.com/wazuh/wazuh

Affected ranges

Type

GIT

Repo

https://github.com/wazuh/wazuh

Events

Introduced

d3e254e3a9219bbeb6a844259144257883d8f02e

Introduced

b3de9acf06147d614f053e87f959a75a0a132e86

Fixed

f753aefc8abeb55533c503f3d9fe7eb8cba59953

Fixed

44c2925b46bd058d2426bd44ed1b3e5d7b7b03b4

Fixed

1a38d11574c6d35a4272e1e7145d55d293e7dda4

Fixed

813add3575ecd4df484b2326715ca78f65505b4e

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "4.9.0"
        },
        {
            "fixed": "4.10.4"
        },
        {
            "introduced": "4.11.0"
        },
        {
            "fixed": "4.14.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41424.json"