Storyden versions through 1.26.16 contain a privilege escalation flaw that allows any user possessing the MANAGE_ROLES permission to grant themselves or another user the ADMINISTRATOR role. By invoking the AccountAddRole API endpoint on a target account or creating and updating roles via RoleCreate and RoleUpdate, an attacker can elevate or create an administrator account, thereby gaining full control over the instance.

The vulnerability affects the Southclaws Storyden product, specifically all releases up to and including version 1.26.16. Any deployment running these releases without the patch is susceptible. Upgrading beyond 1.26.16 should remove the issue.

The CVSS base score of 8.6 classifies this as High severity, indicating a significant impact if exploited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via authenticated API calls, so the risk is heightened for systems where MANAGE_ROLES is granted to users who are not administrators. The vulnerability accepts standard HTTP requests; based on the description, it can be exploited remotely if the instance is publicly exposed.