Wazuh, a free and open‑source threat prevention platform, suffered a privilege escalation flaw caused by the update‑user API endpoint passing the request user field instead of the authenticated token subject. This bypasses the framework’s reserved‑account protection logic and allows an authenticated user with the users_admin role to overwrite the passwords of protected administrator accounts (user IDs ≤99) such as the superuser, thereby gaining full administrative control. The vulnerability is classified as CWE‑863, reflecting failures in authorization logic where unauthorized manipulation of privileged resources is possible. The impact is that an attacker who can authenticate to the Wazuh API and assumes a users_admin role can remotely elevate privileges and fully compromise the system, potentially leading to data exfiltration, tampering, or further lateral movement.

The vulnerability affects Wazuh deployments running any release from 4.9.0 up to but not including 4.10.4, and also the 4.14.x series prior to 4.14.6. Versions 4.10.4 and 4.14.6 contain the fix. Organizations should verify their running version and update accordingly.

The CVSS score of 8.2 indicates high severity. While an EPSS score is not provided, the vulnerability requires an authenticated user with the users_admin role, meaning the exploitation likelihood is tied to the prevalence of such roles in the environment. The issue is not listed in the CISA KEV catalog, reducing immediate exposure to known exploits. Attackers can trigger the flaw through normal API operations; an existing users_admin account can simply send a PUT request to change another protected account’s password.