CVE-2026-38470: GazellePW Access Control Bypass Vulnerability

CVE-2026-38470 Overview

CVE-2026-38470 is a broken access control vulnerability in the API user endpoint of GazellePW (GazellePosterWall), a private tracker web application. The flaw exists in commit 86c4bedf727691b5a97af42a4864869d18446449 and permits unprivileged, authenticated users to enable or disable arbitrary user accounts. Attackers exploit the issue by issuing req=disable or req=enable actions through a normal user-created API token. The endpoint fails to verify administrative privileges before executing state-changing operations against other user accounts.

Critical Impact
Any authenticated low-privilege user holding a self-issued API token can disable arbitrary accounts, including administrators, causing account lockout and enabling further exploit-chain steps against the GazellePW database.

Affected Products

GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449
The affected source file is app/API/User.php
No fixed version has been published in the referenced advisories

Discovery Timeline

2026-08-25 - CVE-2026-38470 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-38470

Vulnerability Analysis

GazellePW exposes an API user endpoint that accepts action parameters such as req=disable and req=enable to change the enabled state of user accounts. The endpoint authenticates the caller using an API token but does not verify that the caller possesses administrative rights before performing the requested action. As a result, a standard user can generate an API token through the normal account settings flow and invoke privileged administrative actions.

The referenced advisory documents a one-click exploit chain that leverages this endpoint as a pivot toward complete database compromise. Attackers can disable administrator accounts to inhibit response, then chain the primitive with other flaws to extract or manipulate tracker data. See the complete exploit chain writeup for the full attack narrative.

Root Cause

The root cause is missing authorization enforcement in the API dispatcher for user-management actions. The code at app/API/User.php line 24 dispatches on the req parameter, and the branches at line 89 and line 107 execute enable and disable operations without a permission check. Broken access control at this layer collapses the security boundary between regular users and site administrators.

Attack Vector

Exploitation requires only a valid low-privilege account on the target GazellePW instance. The attacker registers or uses an existing account, generates an API token from the normal user interface, and then issues an HTTP request to the user API endpoint with the req=disable or req=enable parameter and a target userid. No user interaction from the victim is required. Because API tokens can be created by any authenticated user, mass exploitation across a target instance is straightforward once one account is obtained.

Refer to the vulnerable code at User.php line 24, line 89, and line 107 for the missing authorization checks. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-38470

Indicators of Compromise

HTTP requests to the GazellePW user API endpoint containing req=disable or req=enable sourced from non-administrator API tokens
Unexpected transitions of user accounts to a disabled or re-enabled state without corresponding administrative audit entries
Administrator accounts becoming disabled shortly after new API tokens are generated by low-privilege users
Bursts of user API calls from a single IP address or API token targeting many distinct userid values

Detection Strategies

Correlate web server access logs with the application's user-state audit trail to flag req=enable or req=disable actions performed by tokens not associated with administrative accounts
Baseline the number of enable/disable events per day and alert on statistical deviations
Parse app/API/User.php request patterns in a WAF or reverse proxy and enforce role-based allow-lists for administrative req values

Monitoring Recommendations

Monitor creation and use of API tokens, tying each token to the originating user role at time of use
Alert on any account-state change affecting administrator accounts, regardless of source
Ship GazellePW web and application logs to a centralized analytics platform for cross-referencing token activity with authorization outcomes

How to Mitigate CVE-2026-38470

Immediate Actions Required

Restrict network access to the GazellePW /api endpoints to trusted operators until a patched build is deployed
Revoke all existing user-generated API tokens and disable API-token creation for non-administrator accounts
Audit the users table for unexpected Enabled state changes and restore any accounts that were maliciously disabled
Review site administrator accounts to confirm they remain enabled and are protected by strong credentials

Patch Information

At time of publication, the referenced advisories do not identify a fixed commit for CVE-2026-38470. Operators should track the upstream GazellePW repository for a security update and apply it once available. The remediation must add an administrator authorization check in app/API/User.php before executing the enable and disable branches.

Workarounds

Apply a local patch that inserts an administrator role check at the top of the enable and disable handlers in app/API/User.php
Deploy a reverse-proxy or WAF rule that blocks requests to the user API endpoint carrying req=disable or req=enable unless the calling token belongs to a known administrator
Temporarily disable the API user endpoint by returning HTTP 403 for the affected routes if administrative API access is not required

bash

# Example nginx rule to block enable/disable actions on the user API
location ~ ^/api/user {
    if ($arg_req ~* "^(enable|disable)$") {
        return 403;
    }
}