Which versions of Python are affected by CVE-2026-34406?

APTRS (Automated Penetration Testing Reporting System) versions prior to 2.0.1 contain a critical privilege escalation flaw that allows any user to grant themselves or others superuser access through…. A patch is available.

How to fix or mitigate CVE-2026-34406?

Within 24 hours: Inventory all APTRS deployments and confirm current versions. Within 7 days: Upgrade all instances to APTRS version 2.0.1 or later. Within 30 days: Audit superuser account creation logs for the past 90 days and review access permissions for any accounts that may have been compromised during the window before patching.

Python CVE-2026-34406

Q: What is the CVSS score of CVE-2026-34406?

CVE-2026-34406 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17671 CRITICAL

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-03-31 GitHub_M

Privilege Escalation Python Aptrs

9.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:47 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.1

EUVD ID Assigned

Mar 31, 2026 - 21:46 euvd

EUVD-2026-17671

Analysis Generated

Mar 31, 2026 - 21:46 vuln.today

CVE Published

Mar 31, 2026 - 21:18 nvd

CRITICAL 9.4

DescriptionCVE.org

APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. Prior to version 2.0.1, the edit_user endpoint (POST /api/auth/edituser/<pk>) allows Any user who can reach that endpoint and submit crafted permission to escalate their own account (or any other account) to superuser by including "is_superuser": true in the request body. The root cause is that CustomUserSerializer explicitly includes is_superuser in its fields list but omits it from read_only_fields, making it a writable field. The edit_user view performs no additional validation to prevent non-superusers from modifying this field. Once is_superuser is set to true, gaining unrestricted access to all application functionality without requiring re-authentication. This issue has been patched in version 2.0.1.

AnalysisAI

Privilege escalation in APTRS (Automated Penetration Testing Reporting System) prior to version 2.0.1 allows any user to escalate their own account or modify any other user account to superuser status by submitting a crafted POST request to /api/auth/edituser/<pk> with an is_superuser field set to true. The CustomUserSerializer fails to mark is_superuser as read-only despite including it in serializer fields, and the edit_user view lacks validation to prevent non-superusers from modifying this critical field. No public exploit code or active exploitation has been identified at time of analysis, but the vulnerability is trivial to exploit given basic HTTP client access to the endpoint.

Technical ContextAI

APTRS is a Django REST Framework-based application using a CustomUserSerializer to handle user account modifications. The vulnerability stems from improper serializer configuration in Django REST Framework, specifically the Django ORM permission model. CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) describes the root cause: the serializer explicitly lists is_superuser in its fields but fails to designate it as read_only_fields, rendering it writable by any authenticated or unauthenticated user who can reach the endpoint. The Django User model's is_superuser field is typically a boolean flag that grants unrestricted administrative access to the application. The edit_user view (POST /api/auth/edituser/<pk>) processes serializer validation without additional permission checks specific to the is_superuser attribute, allowing direct attribute modification via REST API.

RemediationAI

Upgrade APTRS to version 2.0.1 or later, which includes a fix committed at https://github.com/APTRS/APTRS/commit/d1f1b3a5d1953082af8e075712ca29742e900d56. The patch adds is_superuser to the read_only_fields list in CustomUserSerializer and implements view-level permission validation to prevent non-superusers from modifying the is_superuser attribute on any user account. Immediate patched version 2.0.1 is available at https://github.com/APTRS/APTRS/releases/tag/2.0.1. Until patching is completed, restrict network access to the /api/auth/edituser/ endpoint using a web application firewall or reverse proxy to limit reach to authenticated users only, though this does not eliminate the underlying privilege escalation risk.