CVE-2026-93968 aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management
Remote attackers can exploit improper privilege management in the UserSerializer update function to escalate privileges within the SxDevOps application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93968?
CVE-2026-93968 is a medium-severity vulnerability in aiyiyi121 SxDevOps, published on 20 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Which versions are affected by CVE-2026-93968?
How do I fix CVE-2026-93968?
No fix has been published for CVE-2026-93968 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93968 being exploited?
There is no known exploitation of CVE-2026-93968 in the wild and no public exploit code.
Sources
Also known as GHSA-4q5m-2j7g-wf56.