CVE-2026-85513

Name of the Vulnerable Software and Affected Versions StackStorm st2 versions prior to 3.9.1

Description Improper privilege management exists in the NoOp RBAC backend component. A remote attacker can manipulate the User argument within the assert user is admin if user query param is provided() function located in the st2api/st2api/controllers/v1/actionexecutions.py file. This issue affects default installations where RBAC (Role-Based Access Control) is disabled.

Recommendations Update StackStorm st2 to version 3.9.1 or later. As a temporary mitigation, restrict access to the assert user is admin if user query param is provided() function.