CVE-2026-38474: GazellePW Access Control Vulnerability

CVE-2026-38474 Overview

CVE-2026-38474 is a broken access control vulnerability in GazellePW (GazellePosterWall), an open-source private tracker platform. The flaw exists in the IP lock manager exposed through tools.php?action=iplock and affects commit 86c4bedf727691b5a97af42a4864869d18446449. Remote authenticated users can add, modify, or delete IP lock entries belonging to arbitrary accounts. The endpoint fails to verify that the authenticated user owns the account being modified, enabling cross-account tampering with account security controls.

Critical Impact
Authenticated attackers can manipulate IP allow/block lists for any user, potentially locking legitimate owners out of their accounts or unlocking accounts to facilitate takeover chains against the GazellePW database.

Affected Products

GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449
classes/iplock.class.php component
sections/tools/managers/iplock.php administrative tool

Discovery Timeline

2026-08-25 - CVE-2026-38474 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-38474

Vulnerability Analysis

GazellePW implements an IP lock feature that restricts account access to a defined set of source addresses. The management interface lives under tools.php and dispatches to the iplock action handler in sections/tools/managers/iplock.php. The handler accepts a target user identifier as a request parameter and invokes methods on the IPLock class defined in classes/iplock.class.php.

The handler does not validate that the target user identifier matches the authenticated session user or that the caller holds administrative privilege sufficient to operate on other accounts. As a result, any authenticated user can supply another account's identifier and perform add, modify, or delete operations on that account's IP lock entries. This is a classic broken access control pattern where authentication is enforced but authorization is missing at the object level.

Root Cause

The root cause is missing object-level authorization on the IP lock management endpoint. The code path assumes the supplied user identifier belongs to the caller and issues database writes without an ownership or privilege check. Any parameter tampering by a logged-in user is honored.

Attack Vector

Exploitation requires an authenticated GazellePW session. The attacker sends a crafted request to tools.php?action=iplock with a target user identifier belonging to another account and the desired IP entry operation. According to the Snaacky Exploit Chain Guide, this primitive can be chained with other GazellePW weaknesses to escalate toward full database compromise.

For technical details on the vulnerable code paths, refer to the GitHub GazellePW IP Lock Class, the GitHub GazellePW Tools Index, and the GitHub GazellePW IP Lock Manager.

Detection Methods for CVE-2026-38474

Indicators of Compromise

Requests to tools.php?action=iplock where the target user parameter differs from the authenticated session user identifier.
Unexpected inserts, updates, or deletes in the IP lock database table affecting accounts that did not initiate the change.
User complaints about being locked out of accounts despite unchanged personal configuration.
Bursts of IP lock modifications originating from a single low-privilege session.

Detection Strategies

Enable verbose access logging on tools.php and correlate the acting user with the target user identifier submitted in iplock requests.
Add application-layer audit records for every insert, update, and delete performed by the IPLock class.
Baseline normal IP lock modification volumes per account and alert on outliers.

Monitoring Recommendations

Forward web server and PHP application logs into a centralized analytics pipeline for cross-session correlation.
Monitor authentication events immediately following IP lock changes to detect follow-on account takeover attempts.
Alert on any account modification action where the acting session identifier does not match the modified account.

How to Mitigate CVE-2026-38474

Immediate Actions Required

Restrict access to tools.php?action=iplock to administrative roles only until an authorization fix is deployed.
Audit the IP lock database table for entries that do not correspond to owner-initiated changes and roll back unauthorized modifications.
Force password resets and re-verification for accounts whose IP lock entries were modified by other users.

Patch Information

No vendor patch is referenced in the advisory data for CVE-2026-38474. Administrators should track the Mosasauroidea/GazellePW repository for a commit that adds ownership validation on the IP lock manager and apply it as soon as it is published.

Workarounds

Add a server-side authorization check in sections/tools/managers/iplock.php that compares the submitted user identifier against the authenticated session and rejects mismatches unless the caller is an administrator.
Restrict the iplock action at the web server layer to a defined administrator IP range while a code fix is prepared.
Disable the IP lock feature in deployments that do not rely on it to eliminate the attack surface.

bash

# Example nginx restriction limiting the iplock action to trusted addresses
location = /tools.php {
    if ($arg_action = "iplock") {
        allow 10.0.0.0/24;
        deny all;
    }
}