CVE-2026-44846

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17

Description A user possessing the users.invite user permission can submit an existing member via the 'POST /api/v1/users/users/invite/' endpoint. This triggers the organization invitation logic within apps/users/api/user.py to execute the user.org roles.set(org roles) function, which replaces the member's current organization roles. This flaw allows for privilege escalation or the downgrading of administrators.

Recommendations Update to version 4.10.17.