CVE-2026-125382
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Nov 10, 2026
Vendor
unknown
Description
Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users.
References
- https://github.com/RamonSilva20/mapos
- https://github.com/RamonSilva20/mapos/blob/v5.2.1/application/helpers/api_helper.php#L51-L125
- https://github.com/RamonSilva20/mapos/commit/9a4c5dc3835b52c12616a73ab60635e96e23ad7a
- https://github.com/RamonSilva20/mapos/pull/3043
- https://github.com/RamonSilva20/mapos/releases/tag/v5.2.2