high7.2
CVE-2026-74037
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.
Impact
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
Affected products
| Product | Affected versions |
|---|---|
| Wazuh 4.0.0 | before 4.14.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.