Search
Find a vulnerability
Search criteria
2 vulnerabilities by Southclaws
CVE-2026-125360 (GCVE-0-2026-125360)
Vulnerability from nvd – Published: 2026-11-09 23:27 – Updated: 2026-11-10 16:26
VLAI
EPSS
VEX
Title
Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment
Summary
Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:26 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Southclaws/storyden/issues/901 | issue-tracking |
| https://github.com/Southclaws/storyden | product |
| https://github.com/Southclaws/storyden/blob/v1.26… | technical-description |
| https://github.com/Southclaws/storyden/commit/bf9… | patch |
| https://www.vulncheck.com/advisories/storyden-thr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Southclaws | storyden |
Affected:
0 , ≤ 1.26.16
(semver)
|
Date Public
2026-11-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:26:06.349015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:26:34.595Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/Southclaws/storyden",
"product": "storyden",
"vendor": "Southclaws",
"versions": [
{
"lessThanOrEqual": "1.26.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:34.228Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #901",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Southclaws/storyden/issues/901"
},
{
"tags": [
"product"
],
"url": "https://github.com/Southclaws/storyden"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Southclaws/storyden/blob/v1.26.16/app/transports/http/bindings/accounts.go#L703-L713"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Southclaws/storyden/commit/bf9d872179dad727f1315b409298677e77355229"
},
{
"name": "VulnCheck Advisory: Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment"
}
],
"title": "Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125360",
"datePublished": "2026-11-09T23:27:34.228Z",
"dateReserved": "2026-11-09T22:03:00.224Z",
"dateUpdated": "2026-11-10T16:26:34.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125360 (GCVE-0-2026-125360)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-10 16:26
VLAI
EPSS
VEX
Title
Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment
Summary
Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:26 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Southclaws/storyden/issues/901 | issue-tracking |
| https://github.com/Southclaws/storyden | product |
| https://github.com/Southclaws/storyden/blob/v1.26… | technical-description |
| https://github.com/Southclaws/storyden/commit/bf9… | patch |
| https://www.vulncheck.com/advisories/storyden-thr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Southclaws | storyden |
Affected:
0 , ≤ 1.26.16
(semver)
|
Date Public
2026-11-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:26:06.349015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T16:26:34.595Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/Southclaws/storyden",
"product": "storyden",
"vendor": "Southclaws",
"versions": [
{
"lessThanOrEqual": "1.26.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:34.228Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #901",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Southclaws/storyden/issues/901"
},
{
"tags": [
"product"
],
"url": "https://github.com/Southclaws/storyden"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Southclaws/storyden/blob/v1.26.16/app/transports/http/bindings/accounts.go#L703-L713"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Southclaws/storyden/commit/bf9d872179dad727f1315b409298677e77355229"
},
{
"name": "VulnCheck Advisory: Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment"
}
],
"title": "Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125360",
"datePublished": "2026-11-09T23:27:34.228Z",
"dateReserved": "2026-11-09T22:03:00.224Z",
"dateUpdated": "2026-11-10T16:26:34.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}