CVE Intelligence
Analysis AI-assisted

CVE-2026-27012: Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php

An unauthenticated flaw in OpenSTAManager, affecting version 2.9.8 and earlier, lets anyone change a user's group by calling modules/utenti/actions.php directly. Attackers could promote accounts into the Amministratori group or demote existing administrators. The record gives a CVSS base score of 9.8 and lists no fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

OpenSTAManager is open source management software for technical assistance and invoicing. The record describes a missing-authentication flaw (CWE-306) in modules/utenti/actions.php that allows an unauthenticated attacker to change a user's group.

Impact

  • An attacker can promote an existing account, such as one named agent, into the Amministratori group.
  • An attacker can demote any user, including existing administrators.
  • The CVSS base score of 9.8 (critical) reflects network reachability, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability, as stated in the record.

Affected products and versions

  • The record lists Devcode Openstamanager and Devcode-it Openstamanager, with version 2.9.8 and earlier affected.
  • No fixed version is listed in the record. This does not mean no fix exists; it means the consulted sources do not provide one.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog according to the record, so no confirmed active exploitation appears in the sources consulted.
  • The SSVC exploitation field is recorded as poc (proof of concept), and one reference is tagged as Exploit. This suggests public exploit-related material may exist, but the record does not confirm its use in attacks.

Remediation and mitigation

  • Upgrade to a release later than 2.9.8 published by the maintainer, after checking the vendor advisory.
  • Until a fix is applied, restrict access to the administrative application to trusted networks where feasible.
  • Review the group membership of all accounts, especially administrators and accounts such as agent, and restore the expected roles.

Detection guidance

  • Audit changes to user group assignments and compare them against an approved baseline.
  • Review web server logs for requests to modules/utenti/actions.php from unexpected sources or without a valid session, and correlate them with account changes.
  • Check for newly created or unexpected administrator-level memberships.

Limitations of the available information

  • The record does not list a fixed version, patch details or workarounds beyond the advisory link.
  • Whether a given deployment is reachable from the internet is unknown.
  • The EPSS probability of 0.00685 (percentile 0.5208) is a statistical estimate and does not confirm exploitation.

Frequently asked questions

What does CVE-2026-27012 allow an attacker to do?

According to the record, an unauthenticated attacker can change a user's group by calling modules/utenti/actions.php directly. This can promote accounts to the Amministratori group or demote existing administrators.

Which versions are affected?

The record lists OpenSTAManager version 2.9.8 and earlier as affected by Devcode and Devcode-it product entries. No fixed version is listed in the record.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV according to the record, so no confirmed active exploitation appears in the sources consulted. The SSVC exploitation value is poc, which indicates proof-of-concept status.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.