CVE-2025-43904
Medium · 4.2CVSS
4.2
EPSS
0.3%
Published
Jan 16, 2026
CISA due date
—
The record
In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | slurm | 0 | 23.11.11-1.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | slurm | 0 | 20.11.9-150300.4.15.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | slurm_22_05 | 0 | 22.05.11-150300.7.12.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | slurm_23_02 | 0 | 23.02.7-150300.7.20.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | slurm_24_11 | 0 | 24.11.5-150300.7.8.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | slurm | 0 | 20.11.9-150400.3.6.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | slurm_22_05 | 0 | 22.05.11-150300.7.12.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | slurm_23_02 | 0 | 23.02.7-150300.7.20.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | slurm_24_11 | 0 | 24.11.5-150300.7.8.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | slurm | 0 | 20.11.9-150400.3.6.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | slurm_22_05 | 0 | 22.05.11-150300.7.12.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | slurm_23_02 | 0 | 23.02.7-150300.7.20.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | slurm_24_11 | 0 | 24.11.5-150300.7.8.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | slurm | 0 | 23.02.7-150500.5.18.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | slurm_24_11 | 0 | 24.11.5-150300.7.8.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | slurm | 0 | 23.02.7-150500.5.18.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | slurm_24_11 | 0 | 24.11.5-150300.7.8.1 |
| SUSE:Linux Enterprise Module for HPC 12 | slurm_20_11 | 0 | 20.11.9-3.22.1 |
| SUSE:Linux Enterprise Module for HPC 12 | slurm_22_05 | 0 | 22.05.11-3.12.1 |
| SUSE:Linux Enterprise Module for HPC 12 | slurm_23_02 | 0 | 23.02.7-3.19.1 |
| SUSE:Linux Enterprise Module for HPC 12 | slurm_24_11 | 0 | 24.11.5-3.8.1 |
| SUSE:Linux Enterprise Module for HPC 15 SP6 | slurm | 0 | 23.02.7-150500.5.18.1 |
| SUSE:Linux Enterprise Module for HPC 15 SP6 | slurm_24_11 | 0 | 24.11.5-150300.7.8.1 |
| SUSE:Linux Enterprise Module for HPC 15 SP7 | slurm | 0 | 24.11.5-150700.3.3.1 |
| SUSE:Linux Enterprise Module for HPC 15 SP7 | slurm | 0 | 23.02.7-150500.5.18.1 |
| SUSE:Linux Enterprise Module for HPC 15 SP7 | slurm_23_02 | 0 | 23.02.7-150300.7.20.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | slurm | 0 | 20.11.9-150400.3.6.2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | slurm | 0 | 23.02.7-150500.5.18.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | slurm | 0 | 20.11.9-150400.3.6.2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | slurm | 0 | 24.11.5-150700.3.3.1 |
| openSUSE:Leap 15.6 | slurm | 0 | 23.02.7-150500.5.18.1 |
| openSUSE:Leap 15.6 | slurm_22_05 | 0 | 22.05.11-150300.7.12.1 |
| openSUSE:Leap 15.6 | slurm_23_02 | 0 | 23.02.7-150300.7.20.1 |
| openSUSE:Leap 15.6 | slurm_24_11 | 0 | 24.11.5-150300.7.8.1 |
| openSUSE:Tumbleweed | slurm | 0 | 24.11.5-1.1 |
Related vulnerabilities
- CVE-2024-48936 SchedMD Slurm before 24.05.4 has Incorrect Authorization. Also affects slurm_24_11
- CVE-2016-10030 The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7… Also affects slurm_20_11
- CVE-2022-29502 SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to… Also affects slurm_22_05
- CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
- CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863
- CVE-2026-96373 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863