Threat database

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-85513 is a medium severity vulnerability in StackStorm st2 up to version 3.9.0 involving improper privilege management. The flaw exists in the function assert_user_is_admin_if_user_query_param_is_provided within the NoOp RBAC backend, allowing remote attackers to manipulate user arguments and gain elevated privileges. This issue affects default installations with RBAC disabled and is distinct from a prior related vulnerability CVE-2022-44009. Exploit code has been publicly released, but no official vendor response or patch is currently available.