CVE-2026-74037

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.7

Description The software fails to invalidate issued tokens for run as users who have zero static roles. This occurs because the check token() function does not consult the blacklist. Consequently, attackers whose administrator grants have been revoked can continue to authenticate and self-link the administrator role to maintain privileged access permanently.

Recommendations Update to version 4.14.8 or later.