Executive brief
BloodHound is a widely-used tool for analyzing Active Directory security. The vulnerability allows unauthorized modification of domain data through a graph write endpoint due to insufficient permission checks. An attacker could modify sensitive domain information, potentially compromising the security posture of an organization's Active Directory environment.
Technical details
An improper authorization vulnerability exists in the NewV2API function of the Graph Write Endpoint (cmd/api/src/api/registration/v2.go) in BloodHound up to version 9.5.1. The vulnerability allows a domain PATCH endpoint to accept requests with insufficient permissions (GraphDBRead instead of the required GraphDBWrite). The flaw is remotely exploitable without authentication requirements. An attacker can manipulate the endpoint to perform unauthorized modifications to the graph database. The issue is resolved in versions 9.6.0-rc1, 9.6.0, and 9.7.0-rc3 via patch 39d1276a63e95a7713f954dea632a19651d9cebb.
Affected products
- SpecterOps BloodHound up to 9.5.1
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in versions 9.6.0-rc1, 9.6.0, and 9.7.0-rc3