Executive brief
PatrowlManager is an open-source security orchestration platform that manages users, scans, and findings. A vulnerability in the user listing API endpoint allows any authenticated user to enumerate all user accounts and their privilege levels (superuser, staff status), exposing sensitive administrative information that should be restricted to authorized personnel.
Technical details
The vulnerability is an improper access control flaw in the user listing API endpoint (list_users_api in users/apis.py). The authorization decorator (@pro_group_required) is commented out, removing the permission check that should restrict access to the UsersManager group. Any authenticated user can call this endpoint to retrieve a complete list of all users with sensitive privilege flags. The root cause is a disabled access control decorator; no user interaction or special conditions are required beyond authentication. An attacker with a low-privilege account can enumerate the full user directory and identify administrative accounts for targeted attacks.
Affected products
- Patrowl PatrowlManager through 1.8.4
Timeline
- 2026-09-16: disclosed