EUVD-2026-70817
GHSA-x4wv-m72p-pcf5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated session (PR:L, AV:N); PATCH write-only operation causes integrity impact only, no confidentiality or availability loss.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component.
AnalysisAI
Improper authorization in SpecterOps BloodHound through version 9.5.1 allows authenticated users holding only GraphDBRead permissions to invoke the PATCH /api/v2/domains/{objectID} write endpoint, effectively bypassing the intended write-permission gate. The commit diff confirms the root cause: the route handler called RequirePermissions(permissions.GraphDBRead) where it should have enforced GraphDBWrite, granting read-only users unauthorized ability to modify domain objects in the BloodHound graph database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated BloodHound session - specifically an account that possesses at least GraphDBRead permission but should not have GraphDBWrite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L yields a score of 5.3, which is a reasonable representation of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SpecterOps BloodHound to version 9.6.0 or later (stable), which contains the authorization fix introduced in commit 39d1276a63e95a7713f954dea632a19651d9cebb. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bloodhound
View allcomponents/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrar
components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawnin
Improper authorization in SpecterOps BloodHound through 9.4.0 lets any authenticated user tamper with the global custom-
Same weakness CWE-285 – Improper Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today