Storyden - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/storyden/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:02:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStoryden: Privilege escalation via role management (CVE-2026-125360)https://feed.craftedsignal.io/briefs/2026-11-10-storyden-privilege-escalation/Tue, 10 Nov 2026 02:02:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-10-storyden-privilege-escalation/Storyden versions through 1.26.16 contain a privilege escalation vulnerability allowing users with MANAGE_ROLES to assign administrative permissions, leading to full instance takeover.Storyden through version 1.26.16 contains a privilege escalation vulnerability. Users assigned the MANAGE_ROLES permission can leverage the AccountAddRole, RoleCreate, or RoleUpdate functions to assign the ADMINISTRATOR permission to any account, including their own. This results in unauthorized administrative access and potential full control over the application instance.

Impact

Successful exploitation allows for complete instance takeover by an account initially possessing only the MANAGE_ROLES permission.

Recommendation

  • Update Storyden to the latest version immediately to remediate the privilege escalation flaw.
  • Review all existing account role assignments and creation logs for evidence of unauthorized role elevation.
  • Restrict the assignment of the MANAGE_ROLES permission to trusted users until the application is patched.
]]>highadvisory