PT-2026-29372 · Aptrs · Aptrs

Jfoz1010 · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34406

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions APTRS versions prior to 2.0.1

Description APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool. A flaw exists in the edit user API endpoint ('/api/auth/edituser/') where a user can elevate their privileges to superuser by submitting a crafted request. Specifically, including "is superuser": true in the request body allows unauthorized modification of the is superuser attribute. The issue stems from the CustomUserSerializer exposing the is superuser field as writable without proper validation within the edit user view. Successful exploitation grants unrestricted access to all application functionality without re-authentication. The vulnerable parameter is is superuser.

Recommendations Update to version 2.0.1 or later.

Exploit

Fix

LPE

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-34406

GHSA-GV25-WP4H-9C35

Affected Products

Aptrs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34406.json · Exploit
• https://github.com/APTRS/APTRS/security/advisories/GHSA-gv25-wp4h-9c35 · Vendor Advisory
• https://github.com/APTRS/APTRS/commit/d1f1b3a5d1953082af8e075712ca29742e900d56 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34406 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34406 · Vendor Advisory
• https://github.com/APTRS/APTRS/releases/tag/2.0.1 · Note
• https://twitter.com/0dayPublishing/status/2039095225872765279 · Twitter Post
• https://twitter.com/CVEnew/status/2039372106949927186 · Twitter Post
• https://twitter.com/PwnedRar_/status/2039472542637773076 · Twitter Post