Storyden: Privilege escalation via role management (CVE-2026-125360)
Storyden versions through 1.26.16 contain a privilege escalation vulnerability allowing users with MANAGE_ROLES to assign administrative permissions, leading to full instance takeover.
CVE search metadata
CVE search record: CVE-2026-125360. Severity: high. CVSS: 7.2. KEV: no. Product: Storyden (<= 1.26.16). Brief: Storyden: Privilege escalation via role management (CVE-2026-125360). Brief link: https://feed.craftedsignal.io/briefs/2026-11-10-storyden-privilege-escalation/
Triage facts
Revision 1- Applicability
- Storyden (<= 1.26.16)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 02:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Storyden through version 1.26.16 contains a privilege escalation vulnerability. Users assigned the MANAGE_ROLES permission can leverage the AccountAddRole, RoleCreate, or RoleUpdate functions to assign the ADMINISTRATOR permission to any account, including their own. This results in unauthorized administrative access and potential full control over the application instance.
Impact
Successful exploitation allows for complete instance takeover by an account initially possessing only the MANAGE_ROLES permission.
Recommendation
- Update Storyden to the latest version immediately to remediate the privilege escalation flaw.
- Review all existing account role assignments and creation logs for evidence of unauthorized role elevation.
- Restrict the assignment of the MANAGE_ROLES permission to trusted users until the application is patched.
Immediate actions
Audit role assignment logs for accounts being granted the ADMINISTRATOR permission
Threat Hunt
Identify accounts that were granted ADMINISTRATOR status by users who were not previously administrators
Data: Application audit logs for RoleCreate, RoleUpdate, and AccountAddRole events
Mitigations
Upgrade to the latest patched version of Storyden
CVE-2026-125360