CVE-2026-92754: PatrowlManager Access Control Vulnerability

CVE-2026-92754 Overview

CVE-2026-92754 is an improper access control vulnerability [CWE-862] in PatrowlManager through version 1.8.4. The flaw resides in the user listing API endpoint defined in users/apis.py, where the authorization decorator has been commented out. Any authenticated user with a low-privilege account can invoke the endpoint and enumerate every registered user along with sensitive account metadata. Exposed fields include privilege flags such as superuser and staff status, which attackers can use to identify high-value targets for follow-on attacks against the vulnerability management platform.

Critical Impact
Authenticated low-privilege attackers can enumerate all PatrowlManager users and identify privileged accounts (superuser, staff) through an unprotected API endpoint.

Affected Products

PatrowlManager versions through 1.8.4
Deployments exposing the users API endpoint to authenticated users
Self-hosted PatrowlManager instances relying on default authorization decorators

Discovery Timeline

2026-09-16 - CVE-2026-92754 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92754

Vulnerability Analysis

PatrowlManager is a Django-based vulnerability management orchestration platform. The user listing API in users/apis.py (lines 29-39 of the 1.8.4 release) is intended to be restricted to administrative users. According to the VulnCheck advisory, the authorization decorator that would enforce this restriction is present in the source but commented out. As a result, the endpoint only enforces authentication, not authorization.

Any authenticated caller receives a JSON response listing all user accounts. The response includes is_superuser and is_staff boolean flags, allowing an attacker to map the administrative attack surface of the platform without triggering account-privilege errors.

Root Cause

The root cause is a missing authorization check [CWE-862]. The view function is decorated for authentication but the role-based authorization decorator is inactive in the shipped source. Django REST Framework and Django view decorators must be explicitly applied; commenting one out silently drops the associated access control without any runtime warning.

Attack Vector

Exploitation requires network access to the PatrowlManager web interface and valid low-privilege credentials. The attacker authenticates, then issues an HTTP GET request to the affected users API route. The server returns a full user roster with role metadata. No special client, payload crafting, or elevated privileges are required. See GitHub issue #473 and the affected code snippet for technical details of the vulnerable route.

Detection Methods for CVE-2026-92754

Indicators of Compromise

Authenticated HTTP GET requests to the PatrowlManager users API endpoint originating from non-administrative accounts.
Application logs showing successful 200 OK responses to the users API from user sessions that never accessed administrative UI paths.
Response payloads containing serialized is_superuser or is_staff fields returned to low-privilege session tokens.

Detection Strategies

Instrument the Django application to log the authenticated principal and role for every call to the users API and alert when the caller lacks staff privileges.
Deploy a web application firewall or reverse proxy rule that inspects the users API path and blocks requests from sessions not tagged as administrative.
Review historical access logs for prior enumeration attempts, focusing on repeated calls to the users endpoint followed by targeted login activity against surfaced accounts.

Monitoring Recommendations

Baseline normal usage of the PatrowlManager API and alert on volumetric spikes to the users endpoint.
Correlate user enumeration events with subsequent authentication failures or password reset requests against the enumerated accounts.
Forward PatrowlManager application and web server logs to a centralized analytics platform for cross-session correlation and long-term retention.

How to Mitigate CVE-2026-92754

Immediate Actions Required

Restrict network access to PatrowlManager to trusted operator networks until a fix is deployed.
Audit existing PatrowlManager user accounts and disable any that are dormant, shared, or unnecessary.
Rotate credentials for accounts flagged as is_superuser or is_staff and enforce multi-factor authentication where supported.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry for versions after 1.8.4. Track the PatrowlManager repository and issue #473 for an upstream patch. Administrators who build from source can restore the authorization decorator in users/apis.py at lines 29-39 to enforce staff-only access, then redeploy the application.

Workarounds

Place PatrowlManager behind a reverse proxy that denies the users API path for non-administrative session cookies or JWT claims.
Apply a local source patch that re-enables the authorization decorator on the vulnerable view and rebuild the container image.
Segment the PatrowlManager instance so that only trusted security engineers can authenticate, reducing the pool of accounts capable of triggering enumeration.

bash

# Example nginx block to deny non-admin access to the users API
location ~ ^/users/api/ {
    if ($cookie_role != "admin") { return 403; }
    proxy_pass http://patrowlmanager_upstream;
}