CVE-2026-56115

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/garybowers/bootimus/issues/84	Exploit Issue Tracking Vendor Advisory
https://www.vulncheck.com/advisories/bootimus-broken-access-control-via-jwtmiddleware-authorization-bypass	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bootimus:bootimus:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Bootimus hasta la versión 0.1.70 contiene una vulnerabilidad de control de acceso roto que permite a usuarios autenticados con bajos privilegios realizar acciones administrativas al explotar una aplicación de roles ausente en la función JWTMiddleware en internal/auth/auth.go, que valida tokens JWT y el estado de la cuenta pero no inspecciona el indicador is_admin. Los atacantes pueden enviar solicitudes a cualquier endpoint bajo la ruta /API/users para crear nuevas cuentas de administrador o restablecer contraseñas de administrador, obteniendo así el control total del servidor y la capacidad de modificar menús de arranque y scripts de instalación servidos a clientes PXE.

Information

Published : 2026-06-23 17:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-56115

Mitre link : CVE-2026-56115

CVE.ORG link : CVE-2026-56115

JSON object : View

Products Affected

bootimus

bootimus

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-56115", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56115", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T17:07:56.273135Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/garybowers/bootimus", "vendor": "garybowers", "product": "bootimus", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.1.70"}], "packageURL": "pkg:github/garybowers/bootimus", "defaultStatus": "affected"}]}], "published": "2026-06-23T17:17:09.287", "references": [{"url": "https://github.com/garybowers/bootimus/issues/84", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/bootimus-broken-access-control-via-jwtmiddleware-authorization-bypass", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients."}, {"lang": "es", "value": "Bootimus hasta la versi\u00f3n 0.1.70 contiene una vulnerabilidad de control de acceso roto que permite a usuarios autenticados con bajos privilegios realizar acciones administrativas al explotar una aplicaci\u00f3n de roles ausente en la funci\u00f3n JWTMiddleware en internal/auth/auth.go, que valida tokens JWT y el estado de la cuenta pero no inspecciona el indicador is_admin. Los atacantes pueden enviar solicitudes a cualquier endpoint bajo la ruta /API/users para crear nuevas cuentas de administrador o restablecer contrase\u00f1as de administrador, obteniendo as\u00ed el control total del servidor y la capacidad de modificar men\u00fas de arranque y scripts de instalaci\u00f3n servidos a clientes PXE."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bootimus:bootimus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77C716AC-C88B-4556-816A-453A08C06F88", "versionEndIncluding": "0.1.70"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}