CVE-2026-85513

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-85513 StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-85513

StackStorm st2 up to 3.9.0 is vulnerable to improper privilege management in the NoOp RBAC backend . The flaw resides in the function assert_user_is_admin_if_user_query_param_is_provided within st2api/controllers/v1/actionexecutions.py, where manipulation of the User query parameter allows a remo...

PT-2026-85521

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert user is admin if user query param is provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes imprope...