Executive brief
Northern.tech Mender Enterprise Server, a platform used for managing and updating IoT device fleets, contained a flaw in its access control system. Under specific configurations where an administrator assigned different permission levels to different device groups, the system would incorrectly grant the higher 'Manage' permission to all groups. This could allow a user to modify or control devices they were only supposed to be able to view, increasing the potential impact if a low-privileged account is compromised.
Technical details
A vulnerability in the Role-Based Access Control (RBAC) system of Mender Enterprise Server allows for privilege escalation within device group management. When a user is assigned 'Read' access to one device group and 'Manage' access to another, the system fails to isolate these permissions, incorrectly granting 'Manage' access across both groups. This flaw is rooted in the logic used to combine multiple RBAC policies. An attacker with an existing low-privileged account could exploit this to perform unauthorized management actions on restricted device groups. The issue is fixed in versions 4.0.2 and 4.1.1; it does not affect the Open Source (Community) edition as RBAC is an Enterprise-only feature.
Affected products
- Northern.tech Mender Enterprise Server before 4.0.2, 4.1.0
Timeline
- 2026-05-27: disclosed: Vulnerability disclosed via Northern.tech blog and CVE published.
- 2026-05-27: patched: Fixed in Mender Server 4.1.1 and 4.0.2.