A logic flaw in JumpServer’s organization invitation API allows a user with the users.invite_user permission to submit an existing member to POST /api/v1/users/users/invite/. The logic then calls user.org_roles.set(org_roles), overwriting the member’s current organization roles. This can give an attacker the ability to grant themselves higher privileges or strip administrators of permissions, leading to compromise of the bastion host’s integrity and availability.

JumpServer, all releases before 4.10.17. The issue was fixed in version 4.10.17 and later, so any deployment running 4.10.0 through 4.10.16 is susceptible.

The vulnerability has a CVSS score of 6.2, indicating moderate severity. EPSS data is not available and the flaw is not listed in CISA KEV, suggesting lower likelihood of widespread exploitation. An attacker must possess the users.invite_user permission, which typically belongs to privileged roles, and must target the invitation endpoint with a crafted request to overwrite an existing member’s roles.