CVEvulnerability

CVE-2026-71403

6.1 MEDIUM Published 2026-09-03 Modified 2026-09-18 Official page ↗
Status
Analyzed
Published
2026-09-03
Last modified
2026-09-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-639

Description

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider principal into any account, so that the next login by the owner of that principal was bound to the victim's account and inherited its role bindings. This issue affects Rancher: before 2.15.1.

Affected configurations

• suse rancher (< 2.15.1)

Related

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References