CVE-2026-92753
PatrowlManager through 1.8.4 Authorization Bypass via Events API
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 16, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 16, 2026
Description
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
PatrowlManagerPatrowl |
|
References
- GitHub Issue #474issue-tracking
- https://github.com/Patrowl/PatrowlManagerproduct
- events API handlers carry only @api_viewtechnical-description
- VulnCheck Advisory: PatrowlManager through 1.8.4 Authorization Bypass via Events APIthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.