CVE-2026-29195

Description

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to another user, it does not include an equivalent check for the super-admin role. This issue has been patched in version 1.5.0.

PUBLISHED Reserved 2026-03-04 | Published 2026-03-07 | Updated 2026-03-07 | Assigner GitHub_M

Problem types

CWE-863: Incorrect Authorization

Product status

References

github.com/...tmaker/security/advisories/GHSA-ch3w-9456-38v3

github.com/gravitl/netmaker/releases/tag/v1.5.0

cve.org (CVE-2026-29195)

nvd.nist.gov (CVE-2026-29195)

Download JSON