CVE-2026-92754: Patrowl Patrowlmanager

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented out. Authenticated attackers with low-privilege accounts can enumerate all users and their privilege flags including superuser and staff status by accessing the endpoint.

Affected products

• Patrowl Patrowlmanager: up to and including 1.8.4

Published 2026-09-16. Last modified 2026-09-23.