Map-OS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/map-os/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:04:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMap-OS: Privilege escalation in REST users API (CVE-2026-125382)https://feed.craftedsignal.io/briefs/2026-11-map-os-privesc/Tue, 10 Nov 2026 02:04:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-map-os-privesc/Map-OS versions 5.0.0 through 5.2.1 contain a privilege escalation vulnerability in the REST API that allows low-privileged users to modify administrative account settings.Map-OS versions 5.0.0 through 5.2.1 contain a privilege escalation vulnerability in the REST users API. An attacker with 'cUsuario' permissions can bypass permission-delegation protections by sending unauthorized POST, PUT, or DELETE requests to the /api/v1/usuarios endpoint. Successful exploitation allows an attacker to assign themselves to the 'Administrador' group, reset the super administrator password, or delete other accounts.

Impact

An authenticated non-administrator user can achieve full control over the Map-OS instance by modifying administrative account attributes or deleting high-privileged users.

Recommendation

  • Upgrade Map-OS to version 5.2.2 or later to patch CVE-2026-125382.
  • Audit logs for the /api/v1/usuarios endpoint to identify suspicious modifications made by non-administrator accounts.
]]>highadvisory