CVE-2026-27012 Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php
Unauthenticated attackers can escalate privileges by modifying user groups via a vulnerable action script in OpenSTAManager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27012?
CVE-2026-27012 is a critical vulnerability in devcode-it openstamanager, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user's group (idgruppo) by directly calling modules/utenti/actions.php. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.
Weakness: CWE-306
Which versions are affected by CVE-2026-27012?
2 open source packages ship an affected version, including devcode-it/openstamanager. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
devcode-it/openstamanager Packagist | All versions to 2.9.8 | None |
devcode-it/openstamanager Packagist | All versions to 2.9.8 | None |
Products include Devcode Openstamanager.
How do I fix CVE-2026-27012?
No fix has been published for CVE-2026-27012 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27012 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27012 exists.
Other vulnerabilities in devcode-it openstamanager
- CVE-2025-69212 OpenSTAManager has an OS Command Injection in P7M File Processing
- CVE-2026-35470 OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
- CVE-2026-28805 OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter
- CVE-2026-35168 OpenSTAManager: SQL Injection via Aggiornamenti Module
- CVE-2025-69214 OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
Sources
Also known as GHSA-247v-7cw6-q57v.