Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.5
CVE-2026-5781: MphRx Minerva 3.6.0: Privilege Escalation Through User Update
CVE-2026-5781 · published 6 months ago
Summary
An authenticated user with user modification privileges can potentially gain administrator access to MphRx Minerva 3.6.0 by manipulating a specific field in an HTTP request. This could allow them to perform actions they shouldn't be able to do. MphRx should be notified and update the system to fix this vulnerability.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| agilonhealth | minerva |
3.6.0 cpe:2.3:a:agilonhealth:minerva:3.6.0:*:*:*:*:*:*:* |
Original advisory text
An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, could allow an authenticated user with user modification privileges to escalate thei...
An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, could allow an authenticated user with user modification privileges to escalate their privileges by sending an HTTP request with a manipulated 'identifier' field. Successful exploitation of this vulnerability could allow an authenticated user to obtain administrator privileges. It is not possible to escalate privileges through the graphical user interface.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-285Improper Authorization
Timeline
Published28 Apr 2026
Updated4 Nov 2026
First seen28 Apr 2026
Sources
CVE-2026-5781 · NVD
Track software like this
Free during beta