Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an authorization bypass in the user management system of the NVIDIA NVFlare Dashboard. The root cause is the lack of validation on the role parameter in the create_user and patch_user_by_creator functions within the Store class in nvflare/dashboard/application/store.py. An attacker could manipulate the role parameter in requests to these functions to either create a new user with 'project_admin' privileges or escalate the privileges of an existing user to 'project_admin'. This grants the attacker full administrative control, leading to potential data tampering, information disclosure, code execution, and denial of service. The patch addresses this by introducing checks in both functions to prevent the 'project_admin' role from being assigned outside of the initial, controlled database seeding process.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nvflare | pip | < 2.7.2 | 2.7.2 |
