CVE-2026-108337

An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already...

CVE-2026-92754

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...

CVE-2026-92754

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint , where the authorization decorator is commented out. This allows authenticated attackers with low-privilege accounts to enumerate all users and their privilege flags, including superus...

CVE-2026-92754: Missing Authorization

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff...

PT-2026-94040

Name of the Vulnerable Software and Affected Versions PatrowlManager versions prior to 1.8.5 Description Improper access control exists in the user listing API endpoint because the authorization decorator is commented out. This allows authenticated attackers with low-privilege accounts to enumera...