CVE-2026-92754 is an improper access control vulnerability in PatrowlManager through version 1.8.4. The issue arises because the authorization decorator on the user listing API endpoint is commented out, effectively disabling authorization checks. As a result, authenticated attackers with low-privilege accounts can access this endpoint to enumerate all users and their associated privilege flags, such as superuser and staff status. This vulnerability exposes sensitive user role information that could aid further attacks or privilege escalation attempts.

The vulnerability allows authenticated low-privilege users to obtain a list of all users and their privilege levels, including superuser and staff status. This information disclosure could facilitate targeted attacks or social engineering but does not directly allow privilege escalation or remote code execution based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the user listing API endpoint to trusted users only or implement additional access controls to prevent unauthorized enumeration.