Canonical MAAS EUVD-2025-201010

Requires a valid but unprivileged authenticated MAAS user account and access to the MAAS websocket/user-management interface; the attacker sends a user.update websocket request with the is_superuser property set to true, which the server fails to validate against the caller's authorization. The key limiting factor is the need for pre-existing authenticated (PR:L) access - this is not exploitable by a fully unauthenticated remote attacker. No victim user interaction and no non-default configuration are required; any default deployment exposing the websocket API to a logged-in standard user is affected within the listed version ranges.

This is a privilege-escalation flaw (CWE-269) in Canonical MAAS reachable over the network websocket interface. The input CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a low-complexity attack by an authenticated, low-privileged user requiring no user interaction, which matches the description exactly. Real-world urgency signals are LOW: EPSS is 0.04% (13th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data. However, the technical impact is severe - successful exploitation yields full administrative control of the MAAS deployment, which manages bare-metal provisioning. CONFLICT TO NOTE: the supplied CVSS vector scores impact as C:H/I:N/A:N (6.5), but 'self-promote to administrator' with 'full administrative control' logically implies high integrity and availability impact as well, so the published 6.5 likely understates true impact - verify scoring with the vendor (Launchpad bug 2115714). On balance this is a meaningful but not emergency priority: the saving grace is that it requires a pre-existing authenticated account, so it is primarily an insider/post-compromise escalation rather than a mass-exploitable remote hole.

An attacker who already holds a low-privileged MAAS user account (e.g. a developer or a compromised standard account) opens the web UI websocket session and crafts or intercepts a user.update message, adding is_superuser:true. Because the server fails to validate that the requester is authorized to set that property, the account is instantly elevated to administrator, giving the attacker control over every managed machine. No public proof-of-concept was identified in the provided data, and no user interaction from a victim is required.