PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56115 garybowers CVE debrief

CVE-2026-56115 is a high-severity vulnerability in Bootimus, a tool for PXE booting and installation. The vulnerability allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function. This function validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients. The vulnerability has a CVSS score of 8.7 and is classified as HIGH. The CVE was published on 2026-06-23T17:17:09.287Z and last modified on 2026-06-25T17:17:01.787Z.

Vendor
garybowers
Product
bootimus
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-07-14
Advisory published
2026-06-23
Advisory updated
2026-07-14

Who should care

Administrators and users of Bootimus, especially those who have not updated to the latest version, should be aware of this vulnerability. The vulnerability allows attackers to gain full control of the server, which could lead to unauthorized access and modification of sensitive data. Users of Bootimus should take immediate action to patch this vulnerability.

Technical summary

The vulnerability is caused by missing role enforcement in the JWTMiddleware function in internal/auth/auth.go. The function validates JWT tokens and account status but fails to inspect the is_admin flag. This allows authenticated low-privileged users to perform administrative actions. The vulnerability can be exploited by sending requests to any endpoint under the /api/users path. The vulnerability has a CVSS score of 8.7 and is classified as HIGH.

Defensive priority

High priority should be given to patching this vulnerability as it allows attackers to gain full control of the server. Administrators should take immediate action to update Bootimus to the latest version.

Recommended defensive actions

  • Update Bootimus to the latest version
  • Review and modify the JWTMiddleware function to inspect the is_admin flag
  • Restrict access to the /api/users path
  • Monitor for suspicious activity on the server
  • Implement additional security measures to prevent similar vulnerabilities

Evidence notes

The vulnerability was reported by Vulncheck and is classified as CWE-862. The CVE record and NVD detail can be found at https://www.cve.org/CVERecord?id=CVE-2026-56115 and https://nvd.nist.gov/vuln/detail/CVE-2026-56115 respectively.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56115 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56115

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56115 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56115

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.