CVE-2026-109119

Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...