Platform
php
Component
devcode-it/openstamanager
Fixed in
2.9.9
2.9.9
CVE-2026-27012 represents a critical privilege escalation vulnerability discovered in OpenSTAManager. This flaw allows attackers to bypass authentication and directly manipulate user group assignments within the application. The vulnerability affects versions of OpenSTAManager up to and including 2.9.8, and a fix is currently available through an upgrade.
The impact of CVE-2026-27012 is severe. An unauthenticated attacker can exploit this vulnerability by directly calling modules/utenti/actions.php to modify the idgruppo field, effectively changing a user's group affiliation. This allows for the promotion of standard users to the highly privileged 'Amministratori' group, granting them full administrative control over the system. Conversely, an attacker could demote existing administrators, disrupting operations and potentially gaining persistent access. This vulnerability essentially grants an attacker the ability to completely compromise the integrity and security of the OpenSTAManager installation.
CVE-2026-27012 was publicly disclosed on 2026-03-03. The vulnerability's simplicity and lack of authentication requirements suggest a potentially high probability of exploitation. There are currently no known public proof-of-concept exploits, but the ease of exploitation makes it likely that one will emerge. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.03% (8% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-27012 is to upgrade OpenSTAManager to a patched version. Unfortunately, a specific fixed version isn't provided in the input. Until a patch is available, consider implementing temporary workarounds. Restrict direct access to modules/utenti/actions.php using a web application firewall (WAF) or proxy server, blocking any external requests to this endpoint. Review and harden access control lists (ACLs) to limit the impact of potential group modifications. Monitor access logs for suspicious activity, particularly attempts to modify user group assignments.
Actualice OpenSTAManager a una versión posterior a la 2.9.8. Esto solucionará la vulnerabilidad de escalada de privilegios que permite a atacantes no autenticados modificar los grupos de usuarios.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27012 is a critical vulnerability in OpenSTAManager versions ≤2.9.8 that allows attackers to bypass authentication and elevate their privileges by manipulating user group assignments.
If you are running OpenSTAManager version 2.9.8 or earlier, you are potentially affected by this vulnerability. Immediate action is recommended.
Upgrade OpenSTAManager to a patched version. Until a patch is available, implement workarounds like WAF rules and ACL restrictions.
While no public exploits are currently known, the vulnerability's simplicity suggests a high probability of exploitation. Monitor your systems closely.
Refer to the OpenSTAManager project website and security advisories for updates and official guidance regarding this vulnerability.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.