EUVD-2026-60469Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
AV:N for network-accessible API, AC:L because exploitation is a single POST with no timing or complexity once permission is held, PR:L because invite_user is a delegated non-administrator organizational permission; A:N as role modification carries no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member's existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17.
AnalysisAI
Privilege escalation in JumpServer prior to 4.10.17 allows an authenticated user holding the users.invite_user permission to silently overwrite any existing organization member's role assignments by re-submitting that member through the invite API endpoint, enabling both upward privilege escalation and downward administrator demotion. The root cause is a single Django ORM call - user.org_roles.set(org_roles) in apps/users/api/user.py - which unconditionally replaces the full many-to-many role set without verifying whether the target already belongs to the organization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an active authenticated session in JumpServer with the `users.invite_user` permission explicitly assigned within the target organization - this is a deliberately delegated organizational capability, not a default user right, so standard unprivileged accounts cannot trigger the vulnerable path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS of 6.2 Medium uses AC:H and PR:H, which may understate practical risk: AC:H implies meaningful technical complexity, yet once the `invite_user` permission is held, the exploit reduces to a single well-formed POST request with no race condition or special timing required - AC:L is arguably more accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade JumpServer to version 4.10.17 or later; this is the confirmed vendor fix, available at https://github.com/jumpserver/jumpserver/releases/tag/v4.10.17 and detailed in the advisory at https://github.com/jumpserver/jumpserver/security/advisories/GHSA-j836-99w5-523r. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today