CVE-2026-74771: Dell PowerProtect One Auth Bypass Vulnerability

CVE-2026-74771 Overview

CVE-2026-74771 is an Authorization Bypass Through User-Controlled Key vulnerability affecting Dell PowerProtect One versions 20.1.0.0 and below. The flaw allows a low-privileged remote attacker to manipulate user-controlled key parameters and access resources belonging to other users or tenants. Successful exploitation leads to information tampering across the affected data protection platform. The weakness is categorized under CWE-639, Authorization Bypass Through User-Controlled Key, commonly known as an Insecure Direct Object Reference (IDOR).

Critical Impact
Authenticated low-privileged attackers can tamper with data belonging to other users by manipulating identifiers, undermining the integrity of protected backup and recovery operations.

Affected Products

Dell PowerProtect One version 20.1.0.0
Dell PowerProtect One versions below 20.1.0.0
Deployments exposing the PowerProtect One management interface to authenticated users

Discovery Timeline

2026-08-26 - CVE-2026-74771 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database
2026-08-26 - Dell published advisory DSA-2026-369

Technical Details for CVE-2026-74771

Vulnerability Analysis

The vulnerability originates in how Dell PowerProtect One validates authorization on requests that reference resources by user-supplied identifiers. The application authenticates the requester but fails to verify that the authenticated principal owns or has permission to modify the referenced object. An attacker with a valid low-privileged account can substitute identifiers in requests to reach resources owned by other users. This class of flaw enables horizontal privilege escalation without requiring credential theft or complex chaining.

The impact is scoped to integrity. The attacker cannot directly read confidential data or halt the service, but can alter records, configurations, or policy objects referenced by the substituted identifier. In a backup and recovery product such as PowerProtect One, tampering with protection policies, job definitions, or asset metadata can degrade the reliability of recovery operations.

Root Cause

The root cause is missing object-level authorization on endpoints that accept a user-controlled key such as an object ID, tenant ID, or asset reference. The application trusts the identifier submitted in the request rather than resolving the caller's permission scope server-side. This pattern is the defining characteristic of CWE-639.

Attack Vector

Exploitation requires network access to the PowerProtect One management plane and a valid low-privileged account. No user interaction is needed. The attacker enumerates or predicts identifiers, then issues modification requests referencing objects owned by other principals. See the Dell Security Update DSA-2026-369 for vendor-specific details.

No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-74771

Indicators of Compromise

Modification events in PowerProtect One audit logs where the acting user does not own the referenced object
Sequential or enumerated identifiers in API request logs from a single low-privileged account
Unexpected changes to protection policies, backup jobs, or asset metadata without matching change tickets
API calls to object-scoped endpoints originating from accounts outside the object's tenant scope

Detection Strategies

Correlate authenticated session identity with the ownership metadata of every modified object in PowerProtect One logs
Baseline normal API access patterns per role and alert on deviations that reference cross-tenant identifiers
Hunt for high-volume iteration of object IDs from a single account within short time windows
Review integrity-impacting operations against change management records

Monitoring Recommendations

Forward PowerProtect One audit and API logs to a centralized SIEM for retention and correlation
Enable alerting on privileged configuration changes and cross-user object modifications
Monitor authentication sources for low-privileged accounts performing administrative-style write operations
Track version and patch state of PowerProtect One appliances against Dell advisories

How to Mitigate CVE-2026-74771

Immediate Actions Required

Apply the Dell-provided fix referenced in advisory DSA-2026-369
Inventory all PowerProtect One instances at version 20.1.0.0 or lower and prioritize patching
Review recent audit logs for cross-user object modifications that predate remediation
Rotate credentials for any low-privileged accounts suspected of misuse

Patch Information

Dell has released a security update for PowerProtect One that addresses this issue. Consult DSA-2026-369 for fixed version details and upgrade procedures. Patching is the only complete remediation because the vulnerability is a server-side authorization defect.

Workarounds

Restrict PowerProtect One management interface access to trusted administrative networks
Apply strict least-privilege on PowerProtect One roles and remove unnecessary low-privileged accounts
Increase audit log retention and enable alerting on integrity-impacting API operations
Segment tenants and administrative scopes where the product supports role separation

bash

# Verify installed PowerProtect One version and confirm patch state per Dell DSA-2026-369
# Replace <appliance> with the management host
ssh admin@<appliance> "ppctl system version"