{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/storyden/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:storyden:storyden:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-125360"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Storyden (\u003c= 1.26.16)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Storyden"],"content_html":"\u003cp\u003eStoryden through version 1.26.16 contains a privilege escalation vulnerability. Users assigned the MANAGE_ROLES permission can leverage the AccountAddRole, RoleCreate, or RoleUpdate functions to assign the ADMINISTRATOR permission to any account, including their own. This results in unauthorized administrative access and potential full control over the application instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for complete instance takeover by an account initially possessing only the MANAGE_ROLES permission.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Storyden to the latest version immediately to remediate the privilege escalation flaw.\u003c/li\u003e\n\u003cli\u003eReview all existing account role assignments and creation logs for evidence of unauthorized role elevation.\u003c/li\u003e\n\u003cli\u003eRestrict the assignment of the MANAGE_ROLES permission to trusted users until the application is patched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T02:02:24Z","date_published":"2026-11-10T02:02:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-10-storyden-privilege-escalation/","summary":"Storyden versions through 1.26.16 contain a privilege escalation vulnerability allowing users with MANAGE_ROLES to assign administrative permissions, leading to full instance takeover.","title":"Storyden: Privilege escalation via role management (CVE-2026-125360)","url":"https://feed.craftedsignal.io/briefs/2026-11-10-storyden-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Storyden","version":"https://jsonfeed.org/version/1.1"}