CVE Alert: CVE-2026-92753 – Patrowl

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.

**Risk verdict:** This is a high-priority access-control weakness for internet-facing deployments, but urgency cannot be raised to “priority 1” because KEV, SSVC exploitation state and EPSS data are unavailable.

**Why this matters:** A basic authenticated account may view security history and tamper with other users’ alerts. This could expose investigation context, undermine analyst confidence and suppress response signals, although direct service disruption or cross-system compromise is not indicated.

**Most likely attack path:** An attacker obtains any valid low-privilege account and sends crafted requests to the events or alerts API over the network. The path requires little effort, no victim interaction and no elevated privileges; scope appears confined to the application, limiting inherent lateral movement.

**Who is most exposed:** Internet-facing, shared or multi-team instances are most exposed, especially where users can self-register, credentials are widely shared or automation accesses the API.

Review API activity by low-privilege accounts.

Flag access, deletion or modification of records outside the requester’s ownership.

Look for bulk access, sequential object identifiers and off-hours use.

Check audit logs for alert changes outside approved workflows.

Mitigation and prioritisation:

Upgrade to the vendor-fixed release as soon as practicable.

Until then, restrict management access through VPN or an identity-aware proxy.

Enforce server-side ownership checks on every endpoint and object.

Revoke suspicious sessions and review altered alerts and event records.

Test integrations after remediation and schedule emergency change approval if exposure is internet-facing.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.