CVE-2026-124496 is a vulnerability in the DRPC HTTP endpoint that allows an authenticated client to act as another user without proper authorization checks. This flaw bypasses the configured impersonation authorizer, enabling execution of DRPC functions restricted to other users. The issue is fixed in version 3.2.0.