Privilege Escalation in Storyden via Role Management

Executive Summary

This vulnerability is a privilege escalation flaw in Storyden versions up to 1.26.16. Users with the MANAGE_ROLES permission can grant the ADMINISTRATOR role to themselves or others without being administrators. Attackers exploit this by calling AccountAddRole on another account or using RoleCreate and RoleUpdate to create admin roles, gaining full control of the instance.

Useful 0 Not Useful 0

Detection Guidance

Check if any non-admin users have the MANAGE_ROLES permission and verify if they can assign the ADMINISTRATOR role to other accounts. Review HTTP request logs for calls to PUT /accounts/{handle}/roles/{role_id} or RoleCreate/RoleUpdate endpoints. Ensure only admin users can grant Administrator permissions.

Useful 0 Not Useful 0

Impact Analysis

If you use Storyden versions up to 1.26.16, an attacker with MANAGE_ROLES could escalate their privileges to ADMINISTRATOR. This allows them to take full control of your Storyden instance, including managing users, roles, and sensitive data, potentially leading to data breaches or unauthorized modifications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Unauthorized privilege escalation may result in data breaches, non-compliance with access control regulations, and potential legal penalties for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Storyden to a version that includes the fix for CVE-2026-125360. Remove MANAGE_ROLES permissions from non-admin users until patched. Audit all role assignments to ensure no unauthorized Administrator roles exist. Monitor for suspicious activity in role management endpoints.

Useful 0 Not Useful 0