Executive brief
PatrowlManager is an open-source security operations orchestration platform used to centralize and manage security scanning and alerting. A flaw in its events and alerts API endpoints allows authenticated users to bypass authorization controls, potentially exposing the complete event history of other users, deleting events they should not have access to, and modifying alerts belonging to colleagues—undermining audit trails and operational security controls.
Technical details
The vulnerability is an authorization bypass (CWE-639/CWE-862) in the REST API endpoints for events and alerts in PatrowlManager through version 1.8.4. The vulnerable endpoints (list_events_api, delete_event_api, ack_alerts_api, archive_alerts_api) lack ownership filtering, allowing any authenticated user to query, delete, or modify events and alerts without checking if the requester owns or has permission to access them. An authenticated attacker can read all platform event history, delete arbitrary events, and change the status of alerts belonging to other users. The vulnerability requires authentication but is network-reachable via the REST API. Patches should add authorization checks to verify the requesting user owns or has appropriate role-based access to the target resource before allowing modifications.
Affected products
- Patrowl PatrowlManager through 1.8.4
Timeline
- 2026-09-16: disclosed