# CVE-2026-50770: Squirro Cognitive Search privilege escalation via access control bypass

Source: https://junglewise.ai/threats/cve-2026-50770-squirro-cognitive-search-privilege-escalation-via-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-50770 · Severity: critical · CVSS 9.8 · Published 2026-08-17

Squirro Cognitive Search is an enterprise search platform that helps organizations find information across connected data sources using AI and machine learning. A vulnerability allows low-privilege users to perform administrative actions—such as viewing all users, uploading files, and accessing logs—by sending crafted requests that bypass access controls. This could enable unauthorized users to compromise data confidentiality, modify system configurations, or gain full administrative control.

Technologies: [Squirro Cognitive Search](https://junglewise.ai/threats/technologies/cognitive-search). Vendors: [Squirro](https://junglewise.ai/threats/vendors/squirro).

## Quick answers

**Is CVE-2026-50770 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50770 being exploited in the wild.

**How severe is CVE-2026-50770?** Critical severity, with a CVSS score of 9.8, published 17 August 2026.

**Which products and versions are affected?** Squirro Cognitive Search before 3.14.2.

**Is there a fix for CVE-2026-50770?** A patch was published on 2026: Fixed in version 3.14.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50770 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-50770?** Check whether you run Squirro Cognitive Search at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper access control flaw affecting Squirro Cognitive Search versions before 3.14.2. The application fails to properly validate user roles and permissions when processing administrative API requests, allowing a user with low-privilege (User role) to perform actions restricted to the Admin role. The attack requires the attacker to be authenticated to the application; they can then reuse their low-privilege session cookie to access protected endpoints such as /v0/users (to list all users), file upload endpoints, and logging interfaces. By intercepting admin requests and replaying them with low-privilege credentials, attackers can circumvent role-based access controls and escalate privileges. The fix is available in version 3.14.2 and later.

## Affected products

- Squirro Cognitive Search before 3.14.2

## Timeline

- 2026-08-17: disclosed
- 2026: patched: Fixed in version 3.14.2

## References

- [https://docs.squirro.com/en/latest/products/cognitive-search.html](https://docs.squirro.com/en/latest/products/cognitive-search.html)
- [https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-50770](https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-50770)

## Related threats

- [Squirro Cognitive Search server-side template injection in password reset](https://junglewise.ai/threats/cve-2026-50772-squirro-cognitive-search-server-side-template-injection-in)
- [Squirro Cognitive Search stored cross-site scripting in email and HTML editor](https://junglewise.ai/threats/cve-2026-50771-squirro-cognitive-search-stored-cross-site-scripting-in-email-and)