CVE-2026-115325

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.7.1

Description An authorization bypass exists in the updateExtClient handler. This flaw allows users with network-scoped permissions to modify external clients belonging to other networks. An attacker can send PUT requests to the '/api/extclients/{network}/{clientid}' endpoint to replace public keys, disable clients, and retrieve WireGuard private keys.

Recommendations Update to a version newer than 1.7.0. Restrict access to the '/api/extclients/{network}/{clientid}' endpoint to minimize the risk of exploitation.