Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member's existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-17T21:16:45.227Z",
  "pubdate": "2026-08-17T21:16:45.227Z",
  "executiveSummary": "An improper authorization and access control vulnerability exists in JumpServer prior to version 4.10.17, specifically within the organization invitation mechanism handled by the REST API endpoint POST /api/v1/users/users/invite/.\nThe vulnerability allows an authenticated attacker holding the users.invite_user permission to submit an existing organization member to the invitation endpoint.\nUpon processing this request, the application executes user.org_roles.set(org_roles) in apps/users/api/user.py, which overwrites and replaces the targeted member's existing organization roles rather than handling or rejecting the duplicate invitation appropriately.\nThe primary impact of this flaw includes privilege escalation, enabling malicious actors to elevate standard users to administrative roles, or conversely, performing denial-of-service and disruption attacks by downgrading legitimate administrators.\nExploitation requires authenticated access with specific low-level administrative privileges (users.invite_user) and network access to the API endpoint.\nThe risk is mitigated by updating the affected JumpServer installation to version 4.10.17 or later, where the organization invitation logic has been corrected.",
  "technicalDetails": "The vulnerability resides in the backend user management and organization invitation logic of JumpServer, specifically implemented in apps/users/api/user.py.\nThe vulnerable component is exposed via the HTTP POST method at the API endpoint /api/v1/users/users/invite/.\nThe root cause of the vulnerability stems from inadequate input validation and flawed state management during the organization invitation workflow for users who are already members of the organization.\nWhen a user possessing the users.invite_user permission initiates a request to the POST /api/v1/users/users/invite/ endpoint containing the identifier of an existing organization member, the application fails to verify whether the target user already possesses an active membership and role assignment within the specified context.\nInstead of returning a validation error or safely ignoring the duplicate invitation request, the backend logic unconditionally executes the Object-Relational Mapping (ORM) operation user.org_roles.set(org_roles).\nThis Django ORM set() method clears any existing relations associated with the user's organization roles and replaces them with the newly supplied role set defined in the invitation payload.\nThe attack flow proceeds as follows: First, an authenticated attacker obtains or uses an account with the users.invite_user permission. Second, the attacker crafts an HTTP POST request targeting /api/v1/users/users/invite/, supplying the user ID of an existing victim member along with a manipulated set of organization roles (org_roles). Third, the server processes the request without verifying pre-existing membership status. Fourth, the execution of user.org_roles.set(org_roles) in apps/users/api/user.py overwrites the victim's current role mappings in the database.\nDepending on the payload supplied by the attacker, this behavior results in direct privilege escalation (e.g., assigning administrator roles to a low-privileged user) or administrative privilege downgrade (e.g., stripping administrative roles from security personnel or system maintainers, thereby locking them out of critical operational functions).\nThe vulnerability affects JumpServer versions prior to 4.10.17, requires active authentication, demands the specific users.invite_user permission, and is exploitable over the network via standard HTTP APIs."
}