Is CVE-2026-92754 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92754?

CVE-2026-92754 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-92754

Description

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.