CVE-2026-33906

Attacker must possess valid credentials for an account assigned the NetworkManager role in ellanetworks/core prior to v1.7.0. The NetworkManager role must have been granted backup and restore permissions in the target deployment (this was the default configuration in vulnerable versions). The application's database must be SQLite-based and the restore endpoint must be accessible to the authenticated NetworkManager. Exploitation is limited to authenticated users with pre-existing elevated (though not Admin) privileges-this is not exploitable by unauthenticated attackers or standard low-privilege users. The network vector (AV:N) indicates remote exploitation is possible once NetworkManager credentials are obtained, but those credentials themselves require prior compromise or insider access.

CVSS 7.2 (High) reflects the severe impact (complete compromise of confidentiality, integrity, and availability) but is appropriately constrained by requiring high-privilege authentication (PR:H) and network access. The NetworkManager role itself is a privileged position, limiting the initial attacker pool to users already trusted with network infrastructure management. EPSS score of 0.03% (8th percentile) suggests very low probability of widespread exploitation, consistent with a vulnerability requiring pre-existing privileged access to a specialized network management platform. No CISA KEV listing indicates no confirmed active exploitation. The CVSS attack complexity is Low (AC:L) because once NetworkManager access is obtained, exploitation is straightforward-simply craft a SQLite database and upload it. However, real-world risk is moderate rather than critical because: (1) attackers must first compromise a NetworkManager account, (2) the target is a specialized Go package rather than widely deployed infrastructure, (3) database restore operations may trigger logging or require maintenance windows that provide detection opportunities, and (4) the narrow deployment base limits attacker ROI. Organizations using ellanetworks/core should prioritize patching if NetworkManager accounts exist, but this is not an internet-wide threat.

An attacker compromises a NetworkManager account through credential theft or insider threat. They export the production SQLite database, modify it offline to add an Admin user account under their control or elevate their existing account's role to Admin, then use the NetworkManager role's restore permission to upload the tampered database file. The application accepts the malicious SQLite file without validation and replaces the production database. The attacker now logs in with Admin privileges, accessing restricted user management functions, modifying audit logs to cover tracks, and reconfiguring operator identity settings to establish persistence.