privilege escalation possible #1719

New Issue

OVERLORD · 2026-02-05T01:42:20+03:00

OVERLORD commented

2026-02-05 01:42:20 +03:00

Originally created by @Defelo on GitHub (May 7, 2020).

Describe the bug
A non-admin user with the Manage users permission can obtain admin privileges by giving himself the admin role.

Steps To Reproduce
Steps to reproduce the behavior:

Add a custom role with the Manage users permission
Add a new user with this new role but without the admin role
Login as the new user
Go to your own Users settings
Give yourself the admin role
You should now have admin privileges

Expected behavior
It should not be possible to obtain more privileges than you already have.

Your Configuration (please complete the following information):

Exact BookStack Version (Found in settings): v0.29.1
Hosting Method: Docker

Originally created by @Defelo on GitHub (May 7, 2020). **Describe the bug** A non-admin user with the `Manage users` permission can obtain admin privileges by giving himself the admin role. **Steps To Reproduce** Steps to reproduce the behavior: 1. Add a custom role with the `Manage users` permission 2. Add a new user with this new role but without the admin role 3. Login as the new user 4. Go to your own `Users` settings 5. Give yourself the admin role 6. You should now have admin privileges **Expected behavior** It should not be possible to obtain more privileges than you already have. **Your Configuration (please complete the following information):** - Exact BookStack Version (Found in settings): v0.29.1 - Hosting Method: Docker

OVERLORD added the 🛠️ Enhancement 📖 Docs Update 🔒 Security labels 2026-02-05 01:42:20 +03:00

OVERLORD closed this issue

2026-02-05 01:42:20 +03:00

OVERLORD commented

2026-02-05 01:42:24 +03:00

@ssddanbrown commented on GitHub (May 15, 2020):

Thanks for reporting @Defelo.

To be honest, this is known and intended behaviour. A Manage users person could also update the password for a more privileged person to gain power. The Manage roles permission will have some similar cases. And Manage app settings since they could alter the default registration role.

I think it'll get more complicated than it's worth to diff permissions between users upon actions, such a role change, to prevent escalation of privileges.

We should address the fact that people may underestimate the power of the first three system permissions (Manage Users, Manage app settings and Manage roles & role permissions), I think some added warning text surrounding those permission options would go a long way.

@ssddanbrown commented on GitHub (May 15, 2020): Thanks for reporting @Defelo. To be honest, this is known and intended behaviour. A `Manage users` person could also update the password for a more privileged person to gain power. The `Manage roles` permission will have some similar cases. And `Manage app settings` since they could alter the default registration role. I think it'll get more complicated than it's worth to diff permissions between users upon actions, such a role change, to prevent escalation of privileges. We should address the fact that people may underestimate the power of the first three system permissions (`Manage Users`, `Manage app settings` and `Manage roles & role permissions`), I think some added warning text surrounding those permission options would go a long way.

OVERLORD commented

2026-02-05 01:42:32 +03:00

@ssddanbrown commented on GitHub (Aug 4, 2020):

I've now added a warning to such permissions that could allow escalation. This will be part of v0.30:

I've marked this as a "Docs Update" as a reminder to put a note in the update details that admins should review their roles if they did not previously expect such escalation to be possible.

Thanks again for reporting @Defelo

@ssddanbrown commented on GitHub (Aug 4, 2020): I've now added a warning to such permissions that could allow escalation. This will be part of v0.30: ![image](https://user-images.githubusercontent.com/8343178/89305959-2d683100-d667-11ea-85e6-f326d85f3fba.png) I've marked this as a "Docs Update" as a reminder to put a note in the update details that admins should review their roles if they did not previously expect such escalation to be possible. Thanks again for reporting @Defelo

OVERLORD referenced this issue

2026-02-05 10:19:05 +03:00

[PR #1719] [MERGED] Add feature to send test e-mails #5868

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#1719