UpSnap, a wake on LAN web application, suffers from an authentication bypass and privilege escalation vulnerability in versions 4.4.1 through 5.3.5. The vulnerable endpoint POST /api/upsnap/init-superuser in pb.HandlerInitSuperuser lacks authentication, setup tokens, IP allow-listing, and rate limiting, relying solely on a totalSuperusers > 0 check that is false on fresh installs. This allows an unauthenticated attacker to register the initial superuser account, obtain a long-lived JWT, and escalate privileges to root remote code execution via exec.CommandContext executing shell commands. The vulnerability is fixed in version 5.4.0.

An unauthenticated network-adjacent attacker can create the initial superuser account, gaining full administrative access. This leads to complete system compromise including remote code execution with root privileges. The vulnerability has a CVSS score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.

Upgrade to UpSnap version 5.4.0 or later, which fixes the authentication bypass and privilege escalation vulnerability. Until patched, restrict network access to the vulnerable endpoint and monitor for unauthorized superuser registrations. Patch status is not explicitly confirmed in vendor advisories; however, version 5.4.0 is stated as the fix.