CVE-2020-36969: Tildeslash M/monit

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Attackers can send a POST request to the /api/1/admin/users/update endpoint with a crafted payload to grant administrative access to a standard user account.

Affected products

• Tildeslash M/monit: version 3.7.4 only

Published 2026-01-28. Last modified 2026-06-17.