What is GHSA-7fq5-f2mw-c994?

GHSA-7fq5-f2mw-c994 is a security advisory published by GitHub Security Advisories with unknown severity. The DRPC HTTP endpoint lets an authenticated client act as another user without applying the...

Which CVE IDs does GHSA-7fq5-f2mw-c994 cover?

GHSA-7fq5-f2mw-c994 covers the following CVE IDs: CVE-2026-124496. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-7fq5-f2mw-c994unknown

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the...

Vendor

GitHub Security Advisories

Published

November 11, 2026

Last Modified

November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-124496 →

📋 Description

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-124496
https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr
http://www.openwall.com/lists/oss-security/2026/11/11/5
https://github.com/advisories/GHSA-7fq5-f2mw-c994