signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity (SignalK signalk-server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.43 % · percentile 38 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.
Weaknesses (CWE)
- CWE-285 — Improper Authorization
- CWE-288 — Authentication Bypass Using an Alternate Path or Channel
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L | GitHub_M |
| CVSS 3.1 | CRITICAL 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-x8hc-fqv3-7gwf — Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
European references
- ENISA EUVD · EUVD-2026-18372
- GCVE · GCVE-0-2026-33950
Affected configurations (NVD CPE)
cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*< 2.24.0cpe:2.3:a:signalk:signal_k_server:2.24.0:beta1:*:*:*:*:*:*cpe:2.3:a:signalk:signal_k_server:2.24.0:beta2:*:*:*:*:*:*cpe:2.3:a:signalk:signal_k_server:2.24.0:beta3:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SignalK · signalk-server | affected < 2.24.0-beta.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |