Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Netmaker lets admin upgrade to super‑admin

CVE-2026-29195 · published 8 months ago
Summary

In Netmaker versions before 1.5.0, an admin could change a user’s role to super‑admin when updating the account, giving them full control of the system. This could let a lower‑privileged staff member gain unrestricted access. Upgrade to Netmaker 1.5.0 or later to close the gap.

What to do
  • Update github.com gravitl to version 1.5.0.
  • Update gravitl github.com/gravitl/netmaker to version 1.5.0.
  • Update gravitl netmaker to version 1.5.0 or later.
Affected software
Ecosystem VendorProductAffected versions
go github.com gravitl < 1.5.0
Fix: upgrade to 1.5.0
Go gravitl github.com/gravitl/netmaker < 1.5.0
Fix: upgrade to 1.5.0
– gravitl netmaker < 1.5.0
cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*
Original advisory text
Netmaker: Privilege Escalation from Admin to Super-Admin via User Update
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to another user, it does not include an equivalent check for the super-admin role. This issue has been patched in version 1.5.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published7 Mar 2026
Updated2 Nov 2026
First seen7 Mar 2026
Sources
CVE-2026-29195 · NVD
GHSA-ch3w-9456-38v3 · GHSA
GHSA-ch3w-9456-38v3 · OSV
CVE-2026-29195 · OSV
Track software like this
Free during beta