CVE-2026-33950CWE-285CWE-288CWE-862

signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity

Critical · published April 2, 2026

CVSS v3.1
9.4
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00479 · 40.4th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-862 · Missing Authorization
Published
2026-04-02T16:08Z
EPSS history
Timeline
  • 02 APR 16:08Z
    signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity
    cvelistv5