Rdiffweb: Privilege escalation to administrator in user management API
Summary
Rdiffweb, a web interface for managing rdiff-backup repositories, contains an improper privilege management flaw in its user management API endpoint (/api/users/{username_or_id}). An authenticated user with a low-privilege account can change the role parameter in a POST request and elevate their rights to administrator. The attack is network-based and requires only a valid user account; the CVSS score of 8.8 is based on the CVE record, while VulDB lists 6.3.
Affected
- Rdiffweb versions before 2.10.6 (CNA: 0 to < 2.10.6)
- Versions prior to 2.10.6 released by ikus-soft are affected according to multiple sources
Fixed in
- Upgrade to Rdiffweb 2.10.6 or later
- Fix commits: b529adf2c13a210d10aaf56325de4d3fb2428abe and 4ce35fc2d23ac1cc789186f32bf76603b2eddeb3
Workaround
- Unknown. No vendor workaround found.
- Until the upgrade, limit the number of accounts, restrict access to the web interface and audit admin accounts and recent role changes.
Exploitation
- Known exploitation in the wild: Unknown. Not listed in CISA KEV according to Strix; CISA confirmation not found.
- Public proof of concept: none found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS: 0.0038 (low) at time of snapshot.
Our recommendation
- Upgrade all Rdiffweb instances to version 2.10.6 or later as a priority, especially internet-facing ones.
- Check existing user accounts for unexpected administrator roles and review recent role changes.
- Limit account creation and restrict access to the web interface to trusted networks.
- Monitor logs for unexpected role changes in the user management API.
- Note that the NVD status was reported as Deferred or pending; verify details against the GitLab commits.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitLab Rdiffweb repository gitlab.com
- Fix commit b529adf2c13a210d10aaf56325de4d3fb2428abe gitlab.com
- Fix commit 4ce35fc2d23ac1cc789186f32bf76603b2eddeb3 gitlab.com
- OSV record CVE-2026-109119 osv.dev
- VulDB CVE-2026-109119 vuldb.com
- Vulners CVELIST CVE-2026-109119 vulners.com
- Strix CVE-2026-109119 www.strix.ai
- Patch Gazette: Rdiffweb privilege fix patchgazette.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:04.
Original description (NVD)
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.