Rdiffweb vulnerabilities

1 known vulnerability in Rdiffweb from Ikus-soft. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  rdiffweb: Missing Authorization

  CVE-2026-109119Oct 16, 2026Ikus-soft

  Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.