CVE-2026-42185 Overview
CVE-2026-42185 is a privilege escalation vulnerability in People, an application from La Suite Numérique used to manage users, teams, and permissions. Versions prior to 1.25.0 allow a user holding the Administrator role on a mail domain to send a crafted invitation request that promotes any existing user to the Owner role. The promotion grants full domain ownership immediately and bypasses the standard invitation acceptance step. The flaw maps to [CWE-269: Improper Privilege Management]. Maintainers patched the issue in version 1.25.0.
Critical Impact
An authenticated Administrator can elevate any account, including users with no current domain access, to Owner of the mail domain using a single HTTP request.
Affected Products
- People (suitenumerique/people) versions prior to 1.25.0
- La Suite Numérique deployments embedding the People component
- Self-hosted instances of People exposing the invitation API
Discovery Timeline
- 2026-05-08 - CVE-2026-42185 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-42185
Vulnerability Analysis
The vulnerability resides in the invitation workflow of the People application. The invitation handler accepts a target role and target user from the requester without verifying that the action is permitted for the requester's scope. An authenticated Administrator of a mail domain can issue an invitation that designates an arbitrary existing user as the new Owner of the domain. The server applies the role change immediately and does not require the target to accept the invitation. The impact extends to users who previously had no association with the domain.
Because the Owner role conveys complete authority over the domain, the attacker can manage members, alter permissions, and control domain resources after promotion. The flaw is a business logic and access control failure rather than a memory or injection issue.
Root Cause
The invitation endpoint trusts client-supplied parameters for role assignment without enforcing that only the Owner role can create another Owner. Authorization checks confirm the caller is an Administrator but do not constrain the target role to roles at or below the caller's privilege. This is a classic improper privilege management defect under [CWE-269].
Attack Vector
Exploitation requires a single authenticated HTTP request to the invitation API from an account already holding the Administrator role on a mail domain. The attacker submits an invitation payload specifying the victim's identifier and the Owner role. The server processes the request, promotes the target, and skips any acceptance handshake. No user interaction from the victim is needed, and no additional privileges beyond Administrator are required. The fix in version 1.25.0 is described in the GitHub Security Advisory GHSA-42cf-rv2h-v8rf and the GitHub Commit Details.
Detection Methods for CVE-2026-42185
Indicators of Compromise
- Invitation API requests from Administrator accounts that specify the Owner role as the target role
- Audit log entries showing Owner role assignments to users without a prior pending invitation or acceptance event
- Sudden Owner role grants to accounts that had no previous membership on the affected mail domain
Detection Strategies
- Review application audit logs for role transitions to Owner and correlate them with the originating user, request path, and timestamp
- Flag invitation API calls where the requester role is Administrator and the requested role is Owner
- Alert on Owner role assignments that occur without a corresponding invitation acceptance event
Monitoring Recommendations
- Forward People application logs and authentication events to a centralized logging or SIEM platform for retention and correlation
- Build dashboards that track role escalation events and changes to domain ownership counts over time
- Configure alerts for any new Owner appearing on a mail domain outside of approved change windows
How to Mitigate CVE-2026-42185
Immediate Actions Required
- Upgrade People to version 1.25.0 or later as published in the GitHub Release v1.25.0
- Audit existing Owner assignments on every mail domain and revoke any that cannot be tied to a legitimate change record
- Reduce the number of accounts holding the Administrator role to the minimum operationally required
Patch Information
The maintainers fixed CVE-2026-42185 in People version 1.25.0. The corrective change is referenced in the GitHub Security Advisory GHSA-42cf-rv2h-v8rf and applied in the upstream commit available at GitHub Commit Details. Operators of self-hosted deployments should pull the tagged release and redeploy.
Workarounds
- Restrict access to the invitation API at the reverse proxy layer until upgrade is complete
- Temporarily remove the Administrator role from non-essential accounts to limit the population that can trigger the flaw
- Increase audit log review frequency for role change events on mail domains until the patched version is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
