CVE-2026-41424

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.9.0 through 4.10.3 Wazuh versions 4.14.0 through 4.14.5

Description An issue exists where the endpoint "PUT /security/users/{user id}" in the security controller.py file incorrectly passes request.get("user") instead of request.context['token info']['sub'] as the current user. The remove nones to dict() function removes the resulting None value, preventing the reserved-account protection in security.py from verifying the identity of the requester. Consequently, an authenticated user with the users admin role can overwrite the password of protected administrator accounts with user IDs of 99 or lower, including the wazuh superuser, to gain full administrative control.

Recommendations Update to version 4.10.4. Update to version 4.14.6.