medium4.3
CVE-2026-74032
Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by queryi…
Impact
Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unprotected security endpoints. Attackers can request GET /security/actions and /security/resources, which omit the caller's RBAC policies, to map privileged actions and endpoints for privilege escalation planning.
Affected products
| Product | Affected versions |
|---|---|
| Wazuh From 4.0.0 | before 4.14.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.