Description

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privilege management. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Prior advisory CVE-2022-44009 was reported as a follow-up on the same sink, but this issue is distinct: it needs no Jinja RBAC und affects default install with RBAC disabled. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-04T13:20:11.130Z",
  "pubdate": "2026-09-04T13:20:11.130Z",
  "executiveSummary": "A critical improper privilege management vulnerability exists in the NoOp RBAC backend of StackStorm st2 (up to version 3.9.0).\nThe vulnerability resides within the assert_user_is_admin_if_user_query_param_is_provided function, allowing unauthorized users to execute actions with elevated privileges.\nUnlike prior issues such as CVE-2022-44009, this vulnerability does not rely on Jinja-based RBAC configurations and remains exploitable even in default installations where RBAC is disabled.\nThis flaw allows remote, unauthenticated or low-privileged attackers to manipulate the 'user' query parameter, effectively bypassing security checks intended to restrict administrative actions.\nThe impact includes full unauthorized control over action executions, potentially leading to total system compromise.\nThe vulnerability is currently public, and exploit code is available, increasing the risk of active exploitation. The vendor has not yet released a patch.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the assert_user_is_admin_if_user_query_param_is_provided function located in st2api/st2api/controllers/v1/actionexecutions.py.\nThe logic intended to validate administrative permissions fails to adequately enforce authorization when the 'user' query parameter is supplied in an API request.\nIn the context of the NoOp RBAC backend, the system fails to correctly verify the requesting user's identity against the requested action's privilege requirements.\nAttack flow: An attacker initiates a remote request to the action execution controller. By injecting or manipulating the 'user' query parameter within the API request string, the attacker triggers the flawed assertion function.\nBecause the function fails to perform a rigorous verification of the 'user' argument, it incorrectly assumes the request is authorized, allowing the backend to process the action execution as if it were initiated by an administrator.\nThis bypasses the intended security architecture, where actions should only be executable by authorized personnel. Since the NoOp RBAC component is often active by default, this vulnerability exposes the core execution engine of the StackStorm environment to external manipulation.\nThe absence of secondary checks within the controller layer allows for the escalation of privileges, enabling an attacker to execute arbitrary workflows or commands that should be protected.\nUnlike CVE-2022-44009, which involved specific interactions with Jinja templating within RBAC policies, this vulnerability is foundational to the API controller's logic, rendering it effective on standard, out-of-the-box configurations where RBAC features have been disabled.\nPost-exploitation, an attacker can leverage the action execution engine to interact with integrated services, exfiltrate sensitive data, or move laterally within the network by executing malicious workflows under the guise of an administrative account."
}