Auth bypass in Gravitl Netmaker

CVE-2026-29195

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code c…

Vulnerability class: Broken Access Control

EPSS: 0.000 (3.6th percentile) — read the EPSS interpretation.

Affected products

Gravitl Netmaker — versions < 1.5.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

https://github.com/gravitl/netmaker/security/advisories/GHSA-ch3w-9456-38v3 (x_refsource_CONFIRM)
https://github.com/gravitl/netmaker/releases/tag/v1.5.0 (x_refsource_MISC)