CVE-2026-85513

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85513
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85513.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85513
Published
2026-09-04T12:30:10.474Z
Modified
2026-09-06T03:47:13.817236246Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
Details

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamis_provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privilege management. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Prior advisory CVE-2022-44009 was reported as a follow-up on the same sink, but this issue is distinct: it needs no Jinja RBAC und affects default install with RBAC disabled. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cwe_ids": [
        "CWE-266",
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85513.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/stackstorm/st2

Affected ranges

Type
GIT
Repo
https://github.com/stackstorm/st2
Events
Introduced
04278e920c0111bfc1040a0ab6bf6d04cd2c05b5
Last affected
15e45d07d1b3a2b5330ef07a47dc258e2d56ded0
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.0"
        },
        {
            "last_affected": "3.0"
        },
        {
            "introduced": "3.1"
        },
        {
            "last_affected": "3.1"
        },
        {
            "introduced": "3.2"
        },
        {
            "last_affected": "3.2"
        },
        {
            "introduced": "3.3"
        },
        {
            "last_affected": "3.3"
        },
        {
            "introduced": "3.4"
        },
        {
            "last_affected": "3.4"
        },
        {
            "introduced": "3.5"
        },
        {
            "last_affected": "3.5"
        },
        {
            "introduced": "3.6"
        },
        {
            "last_affected": "3.6"
        },
        {
            "introduced": "3.7"
        },
        {
            "last_affected": "3.7"
        },
        {
            "introduced": "3.8"
        },
        {
            "last_affected": "3.8"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "last_affected": "3.9.0"
        }
    ]
}

Affected versions

3.*
3.0
3.1
3.2
3.3
3.4
3.5
3.6
3.7
3.8
3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85513.json"