CVE-2026-49819
Received Received - Intake

Unauthenticated Privilege Escalation in UpSnap

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-49819

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
seriousm4x upsnap From 4.4.1 (inc) to 5.3.5 (inc)
seriousm4x upsnap 5.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49819 affects UpSnap versions 4.4.1 through 5.3.5. It involves two critical flaws: an unauthenticated initial superuser takeover via POST /api/upsnap/init-superuser and a remote code execution (RCE) vulnerability in device wake commands. The first flaw allows network-adjacent attackers to register the first superuser account without authentication, receiving a long-lived JWT. The second flaw enables attackers with device-edit permissions to inject malicious shell commands via IP or MAC address fields, which execute when devices are woken or shut down.

Detection Guidance

Check if your UpSnap instance is running a vulnerable version (4.4.1 to 5.3.5) by inspecting the version in the web interface or logs. Monitor network traffic for POST requests to /api/upsnap/init-superuser. Look for unexpected superuser account creation or JWT issuance in logs.

Impact Analysis

An attacker could take full control of your UpSnap instance by registering the first superuser account, gaining administrative access. They could then execute arbitrary commands on the server with root privileges, potentially compromising the entire system. If the instance is publicly accessible, attackers on the same network could exploit this remotely. The Docker image running as root exacerbates the risk of full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Unauthorized superuser access may expose sensitive user data, device configurations, or network information. Compliance failures could result in legal penalties, fines, or reputational damage due to inadequate security controls.

Mitigation Strategies

Upgrade to UpSnap version 5.4.0 or later immediately. If upgrading is not possible, disable the /api/upsnap/init-superuser endpoint by setting the UPSNAP_SETUP_TOKEN environment variable and requiring the X-Setup-Token header for setup. Restrict network access to the UpSnap instance to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart