CVE-2026-56115: Bootimus Authentication Bypass – Privilege Escalation Vulnerability

Technical summary

The vulnerability resides in the JWTMiddleware function within internal/auth/auth.go. This middleware is responsible for validating incoming HTTP requests by inspecting JWT tokens and confirming account status. However, the implementation fails to check the is_admin flag before processing requests to the /api/users endpoint. An authenticated user with low-privilege credentials can therefore craft requests to endpoints that should be restricted to administrators—such as user creation and password reset operations—without being denied. The broken access control (CWE-862) stems from incomplete role-based authorization enforcement at the middleware layer. An attacker exploiting this can escalate privileges by creating an administrative account under their control, or by resetting the password of an existing administrator account to lock out legitimate admins and claim their privileges.

Business impact

Control of a Bootimus server translates to control over PXE boot infrastructure, which is often used to provision new systems, deploy operating systems, and configure network devices at scale. An attacker who escalates to admin via this vulnerability can modify boot menus, alter installation scripts, or inject malicious payloads into images served to client machines. In enterprise environments, this could compromise dozens or hundreds of systems during OS deployment or recovery operations, potentially leading to widespread malware distribution, data exfiltration, or ransomware deployment. The impact is compounded if Bootimus is integral to disaster recovery or infrastructure provisioning workflows.

Affected systems

Bootimus through version 0.1.70 is affected. Organizations running any version up to and including 0.1.70 should assume they are vulnerable if the system is network-accessible and has at least one authenticated low-privileged user account provisioned.

Exploitability

Exploitation requires network access and valid low-privileged credentials—meaning an attacker must either hold a legitimate account or obtain one through phishing, credential stuffing, or insider access. The attack itself is trivial to execute once credentials are obtained: a simple HTTP request with an Authorization header containing a valid JWT can trigger the vulnerability. No user interaction, special conditions, or client-side complexity is needed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8 HIGH) reflects the network accessibility, low attack complexity, requirement for prior authentication, and severe confidentiality, integrity, and availability impact.

Remediation

Patch to a version of Bootimus released after 0.1.70 that includes corrected role enforcement in the JWTMiddleware function. Verify against the vendor advisory for the specific patched version number. Until a patch is applied, implement network-level access controls to restrict access to Bootimus to trusted internal networks only, limit the creation of low-privileged user accounts, and monitor for suspicious requests to /api/users endpoints. Consider disabling or isolating Bootimus if it is not actively in use.

Patch guidance

Apply the security update provided by the Bootimus project for versions above 0.1.70. The fix should reinstate the is_admin flag validation in the JWTMiddleware before permitting requests to administrative endpoints. Test the patch in a non-production environment first to confirm that legitimate administrative functions remain available and that low-privileged users are properly blocked from user management operations. After patching, verify that the JWT middleware correctly rejects admin-only requests from non-admin accounts.

Detection guidance

Monitor access logs for the /api/users endpoint, particularly POST or PUT requests originating from low-privileged user accounts or unfamiliar IP addresses. Alert on any attempts to create new users or reset administrator passwords outside of change-control procedures. Inspect JWT tokens in intercepted traffic to correlate low-privilege accounts with requests to admin-restricted paths. Search logs for authentication successes followed immediately by administrative actions under the same session token. If available, enable detailed audit logging in Bootimus to track user creation and password reset events, and establish a baseline of expected administrative activity to spot anomalies.

Why prioritize this

This vulnerability merits immediate attention because it enables unauthenticated privilege escalation via a simple logic flaw, requires only low-privilege credentials to trigger, and directly compromises boot infrastructure—a critical part of system provisioning and recovery. The breach of integrity and confidentiality at scale justifies a HIGH severity rating and urgent patching. Organizations should treat this as a priority equal to remote code execution flaws affecting the same component.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network-reachable attack surface, low attack complexity, and the requirement for prior authentication. The three impact ratings (Confidentiality: High, Integrity: High, Availability: High) account for an attacker's ability to read sensitive boot configurations, modify installation images and scripts, and disrupt boot services. The scope is unchanged because the attacker is already authenticated within the affected system. While the attack requires a valid account, the ease of obtaining low-privilege credentials in many environments and the severity of the resulting compromise elevates the risk significantly.

Frequently asked questions