Authorization Bypass in Wazuh via Unprotected RBAC Endpoints

Executive Summary

CVE-2026-74032 is an authorization bypass vulnerability in Wazuh versions 4.0.0 to 4.14.7. It allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints like GET /security/actions and GET /security/resources. These endpoints omit the caller's RBAC policies, exposing privileged actions and enabling privilege escalation planning.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Wazuh API endpoints /security/actions and /security/resources return RBAC data to low-privilege users. Use curl commands like: curl -k -u user:password https://<wazuh-server>/security/actions and curl -k -u user:password https://<wazuh-server>/security/resources. If these return 200 OK with RBAC details instead of 403 Forbidden, the system is vulnerable.

Compare responses between /security/config (should return 403) and the affected endpoints. Vulnerable systems will show exposed RBAC mappings.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could exploit this to map out privileged actions and endpoints in the Wazuh API. This information could then be used to plan further attacks, such as privilege escalation, potentially gaining unauthorized access to sensitive data or system functions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of RBAC catalogs may result in non-compliance with data protection and access control regulations, potentially leading to legal and financial penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wazuh to version 4.14.8 or later immediately. If upgrading is not possible, restrict access to the /security/actions and /security/resources endpoints via network controls or API gateways until patched.

Useful 0 Not Useful 0