# Poweradmin privilege escalation via API user-update endpoint

Source: https://junglewise.ai/threats/poweradmin-privilege-escalation-via-api-user-update-endpoint-5c29340c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.8 · Published 2026-07-24

Poweradmin is a web-based control panel for managing PowerDNS servers. A security flaw in its programming interface (API) allows a user with limited management permissions to reset the administrator's password. This could lead to a complete takeover of the DNS management system, allowing an attacker to redirect web traffic, intercept emails, or disrupt online services by modifying DNS records.

Technologies: [Poweradmin](https://junglewise.ai/threats/technologies/poweradmin). Vendors: [Poweradmin](https://junglewise.ai/threats/vendors/poweradmin).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.8, published 24 July 2026.

**Which products and versions are affected?** Poweradmin >= 4.0.0, < 4.2.5.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-24: Advisory updated with patched versions 4.2.5 and 4.3.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run Poweradmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the Poweradmin REST API user-update endpoints (V1 and V2). The API fails to mirror security checks present in the web UI, specifically missing a check to prevent non-superusers from editing superuser accounts and failing to verify the 'user_passwd_edit_others' permission before updating a password. An authenticated attacker with a delegated 'user manager' role can exploit this by sending a PUT or PATCH request to /api/v2/users/{id} to change the administrator's password. This results in full account takeover and administrative control over the PowerDNS backend. Patches are available in versions 4.2.5 and 4.3.4.

## Affected products

- poweradmin poweradmin >= 4.0.0, < 4.2.5
- poweradmin poweradmin >= 4.3.0, < 4.3.4

## Timeline

- 2026-07-23: advisory: Initial GitHub Advisory published
- 2026-07-24: patched: Advisory updated with patched versions 4.2.5 and 4.3.4

## References

- [https://api.github.com/users/SaifSalah](https://api.github.com/users/SaifSalah)
- [https://github.com/SaifSalah](https://github.com/SaifSalah)
- [https://api.github.com/users/SaifSalah/gists%7B/gist_id%7D](https://api.github.com/users/SaifSalah/gists%7B/gist_id%7D)
- [https://api.github.com/users/SaifSalah/repos](https://api.github.com/users/SaifSalah/repos)
- [https://avatars.githubusercontent.com/u/16731875?v=4](https://avatars.githubusercontent.com/u/16731875?v=4)
- [https://api.github.com/users/SaifSalah/events%7B/privacy%7D](https://api.github.com/users/SaifSalah/events%7B/privacy%7D)

## Related threats

- [Poweradmin account takeover via OIDC subject collation bypass](https://junglewise.ai/threats/poweradmin-account-takeover-via-oidc-subject-collation-bypass-0bbe481c)
- [Poweradmin IDOR in DNS record editing](https://junglewise.ai/threats/poweradmin-idor-in-dns-record-editing-fefaa5e3)
- [Poweradmin Host Header Injection in OIDC and SAML flows](https://junglewise.ai/threats/cve-2026-54588-poweradmin-host-header-injection-in-oidc-and-saml-flows)
- [Poweradmin CSV Injection in log export functionality](https://junglewise.ai/threats/cve-2026-47693-poweradmin-csv-injection-in-log-export-functionality)