CVE-2026-44846: Jumpserver

Medium severity, CVSS 6.2. EPSS: 0.4% chance of exploitation in the next 30 days.

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member's existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17.

Affected products

• Jumpserver Jumpserver: before 4.10.17 (fixed in 4.10.17)

Published 2026-08-17. Last modified 2026-09-09.