Patrowl PatrowlManager vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Patrowl PatrowlManager: 2 record(s), with affected versions and fixes.
CVE-2026-92754
Medium · 4.3
CWE-862 Sep 16, 2026
PatrowlManager through 1.8.4 Improper Access Control via users API
PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.
CVE-2026-92753
High · 7.1
CWE-862 Sep 16, 2026
PatrowlManager through 1.8.4 Authorization Bypass via Events API
PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.