Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. Prior to version 2.0.1, the edit_user endpoint (POST /api/auth/edituser/<pk>) allows Any user who can reach that endpoint and submit crafted permission to escalate their own account (or any other account) to superuser by including "is_superuser": true in the request body. The root cause is that CustomUserSerializer explicitly includes is_superuser in its fields list but omits it from read_only_fields, making it a writable field. The edit_user view performs no additional validation to prevent non-superusers from modifying this field. Once is_superuser is set to true, gaining unrestricted access to all application functionality without requiring re-authentication. This issue has been patched in version 2.0.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-31 | 1 | Disclosure1 |
| 2026-04-01 | 2 | Disclosure1General1 |
I've been doing research, and i got some new CVEs: CVE-2026-34406 (Critical 9.4) - APTRS CVE-2026-34381 (High 7.5) CVE-2026-34382 (Medium 4.6) https://github.com/APTRS/APTRS/security/advisories/GHSA-gv25-wp4h-9c35 #researching #0days #cibersecurity #hacking #cve
Post summary
The user discloses several new CVEs with their CVSS scores and links to a GitHub advisory, but offers no PoC, exploit, or patch information.
CVE-2026-34406 APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizatio… https://www.cve.org/CVERecord?id=CVE-2026-34406
Post summary
The snippet merely identifies the CVE and points to a CVE record URL, providing no details on exploitation, patching, or technical aspects.
🚨 CVE-2026-34406: APTRS: Privilege Escalation via ... Mass assignment strikes again - Django serializer exposes `is_superuser` as writable field, instant admin escalation fo... https://zerodaysignal.com/vulnerability/CVE-2026-34406 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-34406, a privilege escalation flaw in Django caused by mass assignment of the `is_superuser` field, and links to a vulnerability page for more details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | aptrs | aptrs | - | python | - |