Wazuh version 4.0.0 through 4.14.7 contains an RBAC authorization bypass that allows any authenticated user to read the RBAC catalog by requesting the privileged /security/actions and /security/resources endpoints. The responses exclude the caller's RBAC policies, revealing the full set of privileged actions and available endpoints. This information can be used by low‑privileged users to map privileged resources and plan privilege‑escalation attacks. The flaw is a case of improper authorization (CWE‑863).

The vulnerability affects the Wazuh Manager component of the Wazuh monitoring stack. All releases from 4.0.0 up to, but not including, 4.14.8 are impacted. The product is identified by the vendor Wazuh and the component wazuh-manager.

The CVSS score of 5.3 denotes a medium severity risk. Exploitation requires a valid authenticated session, so the attack vector is internal; it does not allow unauthenticated or remote code execution. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating it is not known to be widely exploited. Nevertheless, the ability to enumerate privileged actions provides adversaries a useful foothold for future privilege‑escalation attempts.