{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/poweradmin--4.3.0--4.3.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Poweradmin (\u003e= 4.0.0, \u003c 4.2.5)","Poweradmin (\u003e= 4.3.0, \u003c 4.3.4)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","web-application","api-vulnerability","account-takeover"],"_cs_type":"advisory","_cs_vendors":["Poweradmin"],"content_html":"\u003cp\u003eA high-severity privilege escalation vulnerability (GHSA-h4hf-v6w5-897x) has been identified in Poweradmin, an open-source web-based management tool for PowerDNS. This flaw allows a non-administrative user with the \u003ccode\u003euser_edit_others\u003c/code\u003e permission to reset the password of any other user, including superuser accounts, through the REST API. This is due to a discrepancy where the API's user-update endpoint (\u003ccode\u003ePUT/PATCH /api/v2/users/{id}\u003c/code\u003e and its V1 equivalent) fails to enforce authorization checks present in the web interface. Specifically, the API lacks safeguards that prevent non-superusers from editing superuser accounts and from changing passwords without the \u003ccode\u003euser_passwd_edit_others\u003c/code\u003e permission. This vulnerability affects Poweradmin versions 4.0.0 through 4.2.4 and 4.3.0 through 4.3.3. Exploitation requires the REST API to be enabled and the existence of a delegated \u0026quot;user manager\u0026quot; role, which is common in many deployments for helpdesk or team lead functions. The result is a complete administrative account takeover with a single API request, allowing full control over DNS infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn administrator configures Poweradmin with the REST API enabled and establishes a delegated \u0026quot;user manager\u0026quot; role that grants \u003ccode\u003euser_edit_others\u003c/code\u003e permission (ID 57) but not \u003ccode\u003euser_is_ueberuser\u003c/code\u003e (ID 53) or \u003ccode\u003euser_passwd_edit_others\u003c/code\u003e (ID 58).\u003c/li\u003e\n\u003cli\u003eAn attacker gains access to credentials for a user assigned to this \u0026quot;user manager\u0026quot; role.\u003c/li\u003e\n\u003cli\u003eThe attacker generates an API key associated with their \u0026quot;user manager\u0026quot; account within Poweradmin.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP PUT or PATCH request targeting the Poweradmin API's user-update endpoint, specifying the superuser's account ID (commonly \u003ccode\u003e1\u003c/code\u003e) in the URL (e.g., \u003ccode\u003ePUT /api/v2/users/1\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe request body includes a JSON payload containing a new password for the targeted superuser account, such as \u003ccode\u003e{\u0026quot;password\u0026quot;:\u0026quot;NewAdminPass1!\u0026quot;}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to missing authorization logic in \u003ccode\u003elib/Domain/Service/ApiPermissionService.php::canEditUser()\u003c/code\u003e, the API permits the non-superuser \u0026quot;user manager\u0026quot; to edit the superuser's account.\u003c/li\u003e\n\u003cli\u003eSubsequently, \u003ccode\u003elib/Domain/Service/UserManagementService.php::updateUser()\u003c/code\u003e processes the request and writes the new password without verifying if the caller possesses \u003ccode\u003euser_passwd_edit_others\u003c/code\u003e permission.\u003c/li\u003e\n\u003cli\u003eThe attacker then uses the newly set password to log into Poweradmin as the superuser, achieving full administrative control over the system and the underlying PowerDNS infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis broken access control and privilege escalation issue (CWE-285, CWE-266) allows any authenticated non-admin user with \u003ccode\u003euser_edit_others\u003c/code\u003e permission to gain full administrative control over affected Poweradmin installations. This directly impacts any Poweradmin deployment where the REST API is enabled and a delegated user management role exists. Upon successful exploitation, the attacker can reset the superuser's password, log in as the administrator, and subsequently control all zones, records, users, and settings within Poweradmin. This effectively grants control over the organization's DNS data managed by PowerDNS, posing a critical risk to network infrastructure and potentially enabling further attacks like traffic redirection or denial of service. The severity is high due to the complete administrative takeover achievable with a single over-the-network request from a low-privilege authenticated position.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Poweradmin installations immediately to a fixed version (Poweradmin 4.2.5 or 4.3.4, or later) to resolve the vulnerability described in GHSA-h4hf-v6w5-897x.\u003c/li\u003e\n\u003cli\u003eDeploy the \u003ccode\u003eDetect Poweradmin API User Password Update Attempt for Superuser\u003c/code\u003e Sigma rule to your SIEM to monitor for suspicious API calls targeting superuser accounts.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for PUT or PATCH requests to \u003ccode\u003e/api/v[12]/users/1\u003c/code\u003e by non-superuser accounts, especially those utilizing API keys, to identify potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eIf web server logs capture request bodies, examine them for JSON payloads containing a \u0026quot;password\u0026quot; field during API user update calls.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:58:37Z","date_published":"2026-07-24T21:58:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-poweradmin-api-privesc/","summary":"A vulnerability in Poweradmin's REST API user-update endpoint allows a non-admin user with 'user_edit_others' permission to reset any user's password, including superusers, leading to full administrative account takeover by exploiting inconsistent authorization rules between the API and web UI.","title":"Poweradmin API Privilege Escalation via User-Update Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-07-poweradmin-api-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Poweradmin (\u003e= 4.3.0, \u003c 4.3.4)","version":"https://jsonfeed.org/version/1.1"}