CVE-2026-56115 is a broken access control vulnerability in garybowers bootimus through version 10.3.2. The JWTMiddleware function in internal/auth/auth.go validates JWT tokens and account status but does not check the is_admin flag, allowing authenticated users with low privileges to escalate their rights. Attackers can send requests to any endpoint under /api/users to create or reset administrator accounts, gaining full administrative control over the server and its PXE boot configurations.

An attacker with low-privileged authenticated access can escalate to full administrative privileges, enabling them to control the server, modify boot menus, and alter installation scripts delivered to PXE clients. This compromises the integrity and security of the boot process and potentially the entire network environment relying on the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious activity related to /api/users endpoints. Avoid granting unnecessary privileges to users and consider additional access control layers if possible.