CVE-2026-85513: Improper Privilege Management in StackStorm st2

This vulnerability in StackStorm st2 (versions 3.0 through 3.9.0) arises from improper privilege management in the assert_user_is_admin_if_user_query_param_is_provided function of the NoOp RBAC backend. The flaw allows remote attackers to manipulate the User argument, bypassing intended access controls and potentially gaining administrative privileges. Unlike CVE-2022-44009, this issue does not require Jinja RBAC and affects default installs with RBAC disabled. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) and public exploit code is available. The StackStorm project has not yet issued a patch or official advisory.

Successful exploitation can lead to unauthorized privilege escalation, allowing remote attackers to gain administrative access to StackStorm st2 instances with RBAC disabled. This could compromise the integrity and control of the affected system. The vulnerability affects default installations, increasing the risk of exploitation in unpatched environments.

As of now, no official patch or fix has been released by the vendor. Users should monitor the StackStorm project for updates and advisories. Until a fix is available, consider enabling RBAC if possible or restricting access to the affected service to trusted users only. Review and limit exposure of the affected endpoints to reduce attack surface. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.