CVE-2026-44846

Received Received - Intake

Privilege Escalation via Role Reassignment in JumpServer

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member's existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-44846

Affected Vendors & Products

Vendor	Product	Version / Range
jumpserver	jumpserver	to 4.10.17 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in JumpServer allows a user with specific permissions to modify another user's organization roles by submitting an existing member to an invitation endpoint. This can lead to privilege escalation or downgrading administrators by replacing their roles.

Detection Guidance

This vulnerability can be detected by checking JumpServer versions prior to 4.10.17. Use commands like 'curl -s http://<jumpserver-address>/api/v1/users/users/invite/ | grep version' or inspect the server version via the admin interface. Verify if user roles were modified unexpectedly in logs or database.

Impact Analysis

An attacker with the users.invite_user permission could escalate their privileges or remove administrative access from legitimate users, potentially gaining unauthorized control over the system.

Compliance Impact

The vulnerability allows privilege escalation or downgrading of administrators by unauthorized users with specific permissions. This could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's access control mandates.

Mitigation Strategies

Immediately upgrade JumpServer to version 4.10.17 or later to address the privilege escalation flaw. Review user permissions to ensure only authorized users have the users.invite_user permission. Monitor for unauthorized role changes or privilege modifications in user accounts.

Hi! I’m here to help you understand CVE-2026-44846. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70