local priviledge escalation: users can self-promote to admin

[Jacopo Rota]

Describe the bug:

Users can self-promote to admin by patching a request to the users websocket handler and change the `is_superuser` property. By intercepting the request - such as during a password change or profile update - an attacker can manually change the is_superuser value from false to true.

Steps to reproduce:

Intercept the user.update and change the `is_superuser` property to True. After that the user has full admin power.

Expected behavior (what should have happened?):

Server error

Actual behavior (what actually happened?):

The user becomes admin

MAAS version and installation type (deb, snap):

Any

MAAS setup (HA, single node, multiple regions/racks):

Any

Host OS distro and version:

Any

Additional context:

[Jacopo Rota (r00ta)]

3.7 is fixed because the UI migrated to the v3 api and they are not vulnerable to this exploit.

[Nick Galanis (nickgalanis)]

Thanks Jacopo, please use CVE-2025-7044 for this issue. I will come back with the evaluation from the SecEng team.

[Jacopo Rota (r00ta)]

Hi @nick, any news?

[Nick Galanis (nickgalanis)]

Hey Jacopo, sorry for the delay. The score we are giving this CVE is CVSS3 High (7.7). You can see the break down here: https://cvss.js.org/#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

[Nick Galanis (nickgalanis)]

Let me know if you have any doubts about that, otherwise I can go ahead and prepare the CVE entry for you, having it ready for when you are ready to publish the issue.

[Jacopo Rota (r00ta)]

We are going to apply the patch in ~1 month for the 3.6.3 and 3.5.9 releases that must be released at the same time. SEG will take care of backporting the patch to 3.3 and 3.4 and release them accordingly at the same time

[Jacopo Rota (r00ta)]

the commit message is gonna be: "fix: Improve users websocket handler error message"

[Jacopo Rota (r00ta)]

released in 3.5.9

[Nick Galanis (nickgalanis)]

CVE-2025-7044 is now published, thus this bug will be public as well.