CVE-2026-29195
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Mar 7, 2026
CISA due date
—
The record
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to another user, it does not include an equivalent check for the super-admin role. This issue has been patched in version 1.5.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260317T205859-150000.1.152.1 |
Related vulnerabilities
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb
- CVE-2026-33997 Moby is an open source container framework. Also affects govulncheck-vulndb
- CVE-2026-27018 Gotenberg is an API for converting document formats. Also affects govulncheck-vulndb
- CVE-2026-33026 Nginx UI is a web user interface for the Nginx web server. Also affects govulncheck-vulndb