CVE-2026-74032: Incorrect Authorization in Wazuh wazuh-manager

CVE-2026-74032 describes an authorization bypass vulnerability in Wazuh wazuh-manager versions >=4.0.0 and <4.14.8. Low-privileged authenticated users can query unprotected endpoints (/security/actions and /security/resources) that omit RBAC policy enforcement, allowing them to read the RBAC catalog. This exposure enables attackers to enumerate privileged actions and endpoints, facilitating privilege escalation planning.

The vulnerability allows unauthorized disclosure of RBAC catalog information to low-privileged authenticated users. While it does not directly grant elevated privileges, it provides attackers with detailed knowledge of privileged actions and endpoints, which could be leveraged in subsequent privilege escalation attempts. The CVSS 4.0 score is 5.3 (medium severity), reflecting limited impact due to required authentication and lack of direct privilege escalation.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only and monitor for suspicious queries to these endpoints.