CVE-2026-30269: Doorman Privilege Escalation Vulnerability

CVE-2026-30269 Overview

CVE-2026-30269 is a privilege escalation vulnerability affecting Doorman, an API gateway and access management platform. The vulnerability exists due to improper access control in the user account update endpoint (/platform/user/{username}), which allows any authenticated user to modify their own account role to a non-admin privileged role without proper authorization checks.

The flaw stems from the update model accepting the role field during self-updates without verifying that the requesting user has the manage_users permission. This broken access control enables low-privileged users to escalate their privileges to high-privileged roles within the application.

Critical Impact

Any authenticated user can escalate their privileges to high-privileged roles by exploiting the missing permission check on self-updates, potentially compromising the entire platform's access control model.

Affected Products

• Doorman v0.1.0
• Doorman v1.0.2

Discovery Timeline

• 2026-04-20 - CVE-2026-30269 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-30269

Vulnerability Analysis

This vulnerability represents a classic broken access control flaw categorized under CWE-269 (Improper Privilege Management). The Doorman application fails to implement proper authorization checks when processing user self-update requests to the /platform/user/{username} endpoint.

When an authenticated user sends a request to update their own profile, the application correctly validates that users can only modify their own accounts. However, the application does not restrict which fields a user can modify during this self-update operation. Specifically, the role field is accepted and processed by the update model without verifying whether the requesting user possesses the manage_users permission.

This oversight means that while the application prevents users from modifying other users' accounts, it fails to prevent users from elevating their own privileges. An attacker with any valid authenticated session can craft a request to change their role to any non-admin privileged role available in the system.

Root Cause

The root cause of this vulnerability lies in the insufficient authorization logic within the user update handler. The application implements user-scoped restrictions (preventing cross-user modifications) but neglects to implement field-level access controls for sensitive attributes like role. The update model blindly accepts and applies the role field value without checking if the requesting user has administrative privileges to perform such role modifications.

Attack Vector

The attack vector is network-based and requires only low-level authenticated access. An attacker must first obtain valid credentials for any user account within the Doorman platform. Once authenticated, the attacker can directly call the user update API endpoint with their own username and include a modified role field in the request body.

The exploitation is straightforward and requires no user interaction. The attacker simply sends a crafted HTTP request (typically PUT or PATCH) to /platform/user/{username} with their username and the desired privileged role. Upon successful processing, the attacker's account inherits the permissions associated with the newly assigned role.

For detailed technical analysis of this vulnerability, refer to the Orxiai Blog CVE-2026-30269 Analysis.

Detection Methods for CVE-2026-30269

Indicators of Compromise

• Unexpected role changes in user accounts, particularly upgrades from low-privileged to high-privileged roles
• Audit log entries showing user self-update requests that include role field modifications
• Users accessing administrative or privileged functionality they were not originally authorized to use
• Abnormal patterns of requests to /platform/user/{username} endpoints containing role parameters

Detection Strategies

• Monitor API logs for PUT/PATCH requests to /platform/user/* endpoints that contain role field modifications
• Implement alerting on any user role changes that occur outside of administrative sessions
• Compare current user role assignments against baseline/authorized configurations to detect unauthorized privilege changes
• Review authentication and authorization logs for patterns of legitimate authentication followed by privilege escalation attempts

Monitoring Recommendations

• Enable verbose logging for all user account modification endpoints
• Implement real-time monitoring for role field changes in user update operations
• Configure SIEM rules to alert on user role modifications where the requester is not an administrator
• Establish baseline role assignments and alert on deviations

How to Mitigate CVE-2026-30269

Immediate Actions Required

• Upgrade Doorman to a patched version if available from the Doorman GitHub repository
• Audit all existing user accounts for unauthorized privilege escalation
• Review access logs for evidence of exploitation attempts targeting the /platform/user/{username} endpoint
• Implement network-level controls to restrict access to the vulnerable endpoint until patching is complete

Patch Information

Organizations should monitor the Doorman GitHub Repository for security updates and patched releases. Given the critical nature of this vulnerability, immediate action should be taken to either upgrade to a fixed version or implement compensating controls.

Workarounds

• Implement an API gateway or web application firewall rule to block or filter requests to /platform/user/* that contain the role field
• Deploy a reverse proxy that strips the role parameter from user self-update requests
• Restrict network access to the Doorman management interface to trusted administrative networks only
• Temporarily disable the user self-update functionality if operationally feasible
• Implement application-level middleware to validate that role modifications only occur from sessions with manage_users permissions

Organizations unable to immediately patch should implement multiple layers of compensating controls while monitoring for exploitation attempts.