Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api/controllers/security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user. remove_nones_to_dict() removes the resulting None value, so the reserved-account protection in framework/wazuh/security.py cannot verify who is making the request. An authenticated user with the users_admin role can overwrite the password of protected administrator accounts with user IDs at or below 99, including the wazuh superuser, and gain full administrative control. This issue is fixed in versions 4.10.4 and 4.14.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-19T17:18:47.837Z",
  "pubdate": "2026-08-19T17:18:47.837Z",
  "executiveSummary": "An improper authorization and authentication context validation vulnerability exists in Wazuh affecting versions from 4.9.0 until 4.10.4 and 4.14.6.\nThe vulnerability resides within the PUT /security/users/{user_id} API endpoint located in api/api/controllers/security_controller.py.\nAn authenticated attacker possessing the users_admin role can exploit this flaw to overwrite passwords of protected administrator accounts, including the wazuh superuser and any account with user IDs at or below 99.\nSuccessful exploitation allows an attacker to bypass reserved-account protections and achieve full administrative control over the Wazuh platform.\nThe issue stems from passing incorrect request context data, which is inadvertently stripped by utility functions, preventing the security framework from verifying the identity of the user initiating the request.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user context within the API controller implementation in api/api/controllers/security_controller.py.\nSpecifically, when processing requests to the PUT /security/users/{user_id} endpoint, the application passes request.get(\"user\") instead of the cryptographically verified token subject identifier, request.context['token_info']['sub'], as the current_user parameter.\nSubsequently, the utility function remove_nones_to_dict() processes the parameters and strips the resulting None value.\nAs a direct consequence, the reserved-account protection logic implemented in framework/wazuh/security.py is rendered incapable of validating the caller's true identity and privileges.\nAn attacker authenticated with the users_admin role can leverage this breakdown in identity verification to target protected system accounts.\nBy issuing a crafted HTTP PUT request targeting user IDs at or below 99, the attacker can successfully modify the password of critical administrative accounts, most notably the wazuh superuser.\nThe attack flow proceeds as follows: 1) The authenticated attacker with users_admin privileges crafts an API request to modify a protected user profile. 2) The vulnerable controller fails to supply the proper authentication context sub claim. 3) Context sanitation removes the missing identifier. 4) The security framework fails to enforce restrictions protecting administrative accounts due to the absent context. 5) The password update operation is executed successfully.\nThis grants the attacker arbitrary control over administrative accounts, leading to full administrative takeover of the affected Wazuh deployment."
}