Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

DevGuard lets unauthenticated users act as admin via header

CVE-2026-42300 · published 5 months ago
Summary

Before version 1.2.2, DevGuard accepted a client‑supplied X‑Admin‑Token header and treated its value as the logged‑in user when no session cookie was present. An attacker who guesses a valid user ID can send requests as that user, and if the user is an organization admin, the attacker can take full control of the organization’s DevGuard data. Upgrade to version 1.2.2 or later to stop this behavior.

What to do
  • Update github.com l3montree-dev to version 1.2.2.
  • Update l3montree-dev github.com/l3montree-dev/devguard to version 1.2.2.
Affected software
Ecosystem VendorProductAffected versions
go github.com l3montree-dev < 1.2.2
Fix: upgrade to 1.2.2
Go l3montree-dev github.com/l3montree-dev/devguard < 1.2.2
Fix: upgrade to 1.2.2
Original advisory text
DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header
DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation admin or owner, this gives the attacker full control over that organisation's DevGuard resources. This vulnerability is fixed in 1.2.2.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-288Authentication Bypass Using Alternate Path
Timeline
Published12 May 2026
Updated4 Nov 2026
First seen5 May 2026
Sources
GHSA-2g9v-7mr5-fgjg · GHSA
CVE-2026-42300 · NVD
GHSA-2g9v-7mr5-fgjg · OSV
GO-2026-4988 · OSV
CVE-2026-42300 · OSV
Track software like this
Free during beta