EUVD-2026-71087

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-85513

StackStorm st2 up to 3.9.0 is vulnerable to improper privilege management in the NoOp RBAC backend . The flaw resides in the function assert_user_is_admin_if_user_query_param_is_provided within st2api/controllers/v1/actionexecutions.py, where manipulation of the User query parameter allows a remo...