CVE-2026-49819

Name of the Vulnerable Software and Affected Versions UpSnap versions 4.4.1 through 5.3.5

Description An authentication bypass and privilege escalation flaw exists in the pb.HandlerInitSuperuser function, accessible via the POST /api/upsnap/init-superuser endpoint. The system fails to implement authentication, setup tokens, IP allow-lists, or rate limiting, relying only on a check for the totalSuperusers variable. On fresh installations, this allows an unauthenticated network-adjacent attacker to register the initial superuser account and obtain a long-lived JSON Web Token (JWT), which is a compact, URL-safe means of representing claims to be transferred between two parties. This can lead to root remote code execution through the exec.CommandContext function using the wake cmd variable.

Recommendations Update to version 5.4.0.