Poweradmin privilege escalation via API user-update endpoint

Executive brief

Poweradmin is a web-based control panel for managing PowerDNS servers. A security flaw in its programming interface (API) allows a user with limited management permissions to reset the administrator's password. This could lead to a complete takeover of the DNS management system, allowing an attacker to redirect web traffic, intercept emails, or disrupt online services by modifying DNS records.

Technical details

A broken access control vulnerability exists in the Poweradmin REST API user-update endpoints (V1 and V2). The API fails to mirror security checks present in the web UI, specifically missing a check to prevent non-superusers from editing superuser accounts and failing to verify the 'user_passwd_edit_others' permission before updating a password. An authenticated attacker with a delegated 'user manager' role can exploit this by sending a PUT or PATCH request to /api/v2/users/{id} to change the administrator's password. This results in full account takeover and administrative control over the PowerDNS backend. Patches are available in versions 4.2.5 and 4.3.4.

Affected products

• poweradmin poweradmin >= 4.0.0, < 4.2.5
• poweradmin poweradmin >= 4.3.0, < 4.3.4

Timeline

• 2026-07-23: advisory: Initial GitHub Advisory published
• 2026-07-24: patched: Advisory updated with patched versions 4.2.5 and 4.3.4

References

• https://api.github.com/users/SaifSalah
• https://github.com/SaifSalah
• https://api.github.com/users/SaifSalah/gists%7B/gist_id%7D
• https://api.github.com/users/SaifSalah/repos
• https://avatars.githubusercontent.com/u/16731875?v=4
• https://api.github.com/users/SaifSalah/events%7B/privacy%7D