CVE-2026-37525
Privilege Escalation in AGL app-framework-binder
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| agl | app-framework-binder | 19.90.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the AGL app-framework-binder (afb-daemon) up to version 19.90.0 and involves a privilege escalation issue in the supervision Do command.
Specifically, the function on_supervision_call nullifies the request credentials before dispatching an API call controlled by the attacker. This means the credentials are set to NULL before the target API executes.
Because the attacker controls the API and verb parameters via JSON input, they can execute any registered API with a NULL credential context.
If the APIs rely on the credentials in the context for authorization, they may fail open when receiving NULL credentials, allowing the attacker to escalate privileges.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with limited privileges to escalate their privileges by executing API calls without proper authorization checks.
Because the credentials are nullified before the API call, APIs that depend on these credentials for security may inadvertently grant higher access or perform sensitive actions.
The impact includes potential unauthorized access to sensitive data, modification of system settings, or disruption of services, as indicated by the high CVSS score (7.8) with high impact on confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows privilege escalation by enabling attacker-controlled API calls with NULL credential contexts, potentially bypassing authorization checks. This could lead to unauthorized access to sensitive data or system functions.
Such unauthorized access and privilege escalation may result in violations of common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.