Map-OS: Privilege escalation in REST users API (CVE-2026-125382)

Map-OS versions 5.0.0 through 5.2.1 contain a privilege escalation vulnerability in the REST users API. An attacker with 'cUsuario' permissions can bypass permission-delegation protections by sending unauthorized POST, PUT, or DELETE requests to the /api/v1/usuarios endpoint. Successful exploitation allows an attacker to assign themselves to the 'Administrador' group, reset the super administrator password, or delete other accounts.

Impact

An authenticated non-administrator user can achieve full control over the Map-OS instance by modifying administrative account attributes or deleting high-privileged users.

Recommendation

• Upgrade Map-OS to version 5.2.2 or later to patch CVE-2026-125382.
• Audit logs for the /api/v1/usuarios endpoint to identify suspicious modifications made by non-administrator accounts.