{"apiVersion":"1.0","identifier":"CVE-2026-44846","description":"JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member-s existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17.","publishedAt":"2026-08-17T21:16:45","lastModifiedAt":"2026-08-18T14:17:07","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44846","cvssScore":6.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L","epssProbability":0.00328,"riskScore":0.64,"affectedProduct":"JumpServer","affectedVersions":"<4.10.17","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-44846","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-44846","en":"https://www.redsauce.net/en/cves/CVE-2026-44846","fr":"https://www.redsauce.net/fr/cves/CVE-2026-44846","pt":"https://www.redsauce.net/pt/cves/CVE-2026-44846","de":"https://www.redsauce.net/de/cves/CVE-2026-44846","sk":"https://www.redsauce.net/sk/cves/CVE-2026-44846","el":"https://www.redsauce.net/el/cves/CVE-2026-44846"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-44846"}}