Rdiffweb CVE-2026-109119

Attacker must hold a valid authenticated Rdiffweb account of any privilege level (PR:L); no administrator rights and no user interaction are required. Exploitation is performed by sending a POST request to the user-management API endpoint /api/users/{username_or_id} with the 'role' parameter modified to an administrator value. The principal limiting factors are: (1) a pre-existing authenticated session/account is mandatory, so instances that do not allow self-registration and tightly control account provisioning reduce exposure to insiders only; and (2) the endpoint must be network-reachable to the attacker. No non-default feature toggle is needed - the flaw is in the standard user-management API's missing authorization check.

This is a genuine, high-priority privilege-escalation flaw rather than an inflated high-CVSS score. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is internally consistent with the description: a network-reachable API endpoint, low attack complexity, and only a single low-privileged authenticated account needed (PR:L) to obtain full administrative control (C:H/I:H/A:H). The one tension worth flagging is that CVSS keeps S:U, yet the bug crosses a privilege boundary (regular user → administrator); this does not change the base score but underscores the real impact. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis - meaning the 8.8 reflects potential severity, not observed mass exploitation. The limiting factor (PR:L: an attacker must already hold a valid account) keeps real-world risk below that of an unauthenticated RCE, but on multi-user Rdiffweb deployments any registered backup user could trivially seize admin, so patching is strongly warranted.

An attacker who holds any low-privileged Rdiffweb account (e.g., a standard backup user, or an account obtained via self-registration or weak provisioning) sends a crafted POST request to /api/users/{username_or_id} that includes a role parameter set to administrator. Because the endpoint fails to authorize the role change (CWE-862), the server accepts it and promotes the attacker to admin, granting full control over all users' backups and configuration. No public exploit code is identified, but the technique is trivial given low attack complexity and no required user interaction.