CVE-2024-58260CWE-863

Rancher update on users can deny the service to the admin

High · published October 2, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-10-02T12:09Z
EPSS history
Timeline
  • 02 OCT 12:09Z
    Rancher update on users can deny the service to the admin
    cvelistv5