Aptrs CVE-2026-34406

APTRS versions prior to 2.0.1. Requires authenticated user access to the POST /api/auth/edituser/<pk> endpoint. Attacker with any valid account can escalate their own or any other user account to superuser by submitting is_superuser: true in request body.

This vulnerability presents critical real-world risk despite the lack of a CVSS vector in available data. Attack vector is NETWORK (POST request to an HTTP endpoint), and attack complexity is LOW (no special conditions required). The privilege escalation is immediate and unrestricted-any user, including unauthenticated users if the endpoint is accessible without authentication, can grant themselves full superuser privileges. The absence of CVSS data is offset by clear exploitation mechanics: the vulnerability is a logic flaw in application code, not a complex cryptographic or memory-safety issue. No EPSS probability is available, but the trivial nature of the exploit (adding one JSON field to a standard HTTP request) strongly suggests high exploitation probability. The fact that a patch was released in version 2.0.1 confirms vendor validation of the severity. SSVC assessment: Exploitation status is UNCONTESTED (code flaw with no mitigation bypass required), automatable via any HTTP client, and technical impact is TOTAL (complete administrative compromise of the application).

An attacker with any user account on an APTRS instance (or without authentication if the endpoint is publicly accessible) sends a POST request to /api/auth/edituser/<user_pk> with JSON body containing is_superuser: true. The CustomUserSerializer accepts the field, the edit_user view does not validate it, and the superuser flag is immediately set on the target account. The attacker then gains full administrative access to the application without requiring re-authentication or additional privilege escalation steps. Attack requires only a basic HTTP client and knowledge of the endpoint structure.