CVE-2026-7165: Privilege Escalation Vulnerability

CVE-2026-7165 Overview

CVE-2026-7165 affects the /addJugador endpoint in the Assassin Game Gaudire application. The endpoint exposes multiple input validation failures [CWE-20] that authenticated attackers can chain to compromise the application. Affected parameters include keyJugador, keyJugadorObjectiu, punts, numObjectiusEliminats, tokens, and urlImatge. Exploitation enables unauthorized modification of other users' records, score falsification to claim physical prizes, self-assignment of administrator privileges, denial-of-service through oversized numeric values, and server-side request forgery (SSRF) against internal infrastructure. The Spanish National Cybersecurity Institute (INCIBE) published the coordinated advisory.

Critical Impact
An authenticated attacker can escalate to administrator, tamper with any user account, exfiltrate internal resources via SSRF, and crash the service hosting active games.

Affected Products

Assassin Game Gaudire application — /addJugador endpoint
All deployments processing untrusted input through the affected parameters
City council deployments that issue physical prizes based on in-game scores

Discovery Timeline

2026-06-22 - CVE-2026-7165 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-7165

Vulnerability Analysis

The /addJugador endpoint accepts client-supplied parameters without authorization or input validation checks. The keyJugador and keyJugadorObjectiu parameters identify player records, but the server does not verify that the authenticated session owns the referenced identifiers. Any logged-in user can therefore overwrite arbitrary player records.

The punts and numObjectiusEliminats fields control in-game scoring. The server accepts arbitrary client-supplied values, allowing attackers to submit fabricated scores. Because participating city councils award real prizes based on these scores, the flaw produces direct financial impact.

The tokens field controls role assignment. The server does not validate the field server-side, so a low-privileged user can submit a request that elevates their account to administrator. The numeric fields additionally accept extremely long values, triggering a service crash that prevents legitimate gameplay.

The urlImatge parameter accepts arbitrary URLs that the server then fetches. This produces a server-side request forgery primitive usable to probe internal IP ranges, reach internal-only services, read local files through supported URI schemes, and call third-party APIs from the server's trust context.

Root Cause

The root cause is improper input validation [CWE-20] combined with missing authorization checks. The endpoint trusts client-supplied identifiers, role tokens, scores, numeric bounds, and outbound URL targets without server-side verification.

Attack Vector

Exploitation requires network access and a low-privileged authenticated session. No user interaction is needed. An attacker submits crafted JSON or form data to /addJugador, selecting the parameter combination that matches the desired outcome — privilege escalation, account tampering, score falsification, denial of service, or SSRF.

The vulnerability is described in the INCIBE Security Notice. No public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-7165

Indicators of Compromise

Requests to /addJugador where keyJugador or keyJugadorObjectiu references an account that does not belong to the authenticated session
POST bodies containing a tokens field that grants administrator role on accounts that previously held lower privileges
urlImatge values pointing to RFC1918 ranges, localhost, 169.254.169.254, or file:// URI schemes
Numeric fields (punts, numObjectiusEliminats) submitted with values exceeding expected ranges or causing backend exceptions

Detection Strategies

Log every /addJugador request with full body and authenticated user identifier, then correlate the session identity against the target keyJugador value
Alert on any role transition where the request originator is not an existing administrator
Flag outbound HTTP requests initiated by the application server toward internal address space or cloud metadata endpoints

Monitoring Recommendations

Monitor application crash logs and process restarts for patterns consistent with oversized numeric input
Track score distributions per user and alert on statistical outliers that precede prize redemption
Review web application firewall (WAF) telemetry for /addJugador payloads containing unexpected URL schemes or non-numeric values in numeric fields

How to Mitigate CVE-2026-7165

Immediate Actions Required

Restrict access to the /addJugador endpoint at the gateway or WAF until a vendor patch is applied
Audit administrator accounts and revoke any role assignments that cannot be traced to a legitimate elevation request
Audit recent prize awards and reconcile scoring history against server-side game telemetry
Block outbound requests from the application server to internal network ranges and cloud metadata services

Patch Information

No vendor patch information is published in the NVD entry. Consult the INCIBE Security Notice for vendor coordination status and apply fixes as they become available.

Workarounds

Enforce server-side authorization by comparing the session-bound user identifier against keyJugador and keyJugadorObjectiu before processing
Reject any request that includes a tokens field unless the caller already holds administrator privileges
Apply strict numeric bounds on punts and numObjectiusEliminats, and reject input exceeding the defined maximums
Validate urlImatge against an allowlist of approved hosts, deny non-HTTPS schemes, and resolve target hostnames to block private address ranges

bash

# Example WAF rule logic to restrict /addJugador inputs
# Block SSRF candidates in urlImatge
SecRule ARGS:urlImatge "@rx (?i)^(file|gopher|ftp|dict)://" \
  "id:1700001,phase:2,deny,status:400,msg:'CVE-2026-7165 SSRF scheme blocked'"

SecRule ARGS:urlImatge "@rx (127\.|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2[0-9]|3[01])\.)" \
  "id:1700002,phase:2,deny,status:400,msg:'CVE-2026-7165 SSRF internal target blocked'"

# Reject tokens field from non-admin sessions
SecRule ARGS_NAMES "@streq tokens" \
  "id:1700003,phase:2,deny,status:403,msg:'CVE-2026-7165 token field not permitted'"

# Enforce numeric bounds
SecRule ARGS:punts "@gt 100000" \
  "id:1700004,phase:2,deny,status:400,msg:'CVE-2026-7165 punts out of range'"