Security Bulletin #26-006 - Privilege Escalation Across Tenants via Improper Endpoint Authorization
First published: 2026-04-16
Last updated: 2026-07-06
CVE: Not yet assigned
EUVD: Not yet assigned
CVSS Score: 8.2 - CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
Affected product(s): DriveLock SE
Affected deployment: DriveLock Cloud and DriveLock On-Premise
DriveLock Cloud: Affected
Disclosure status: Coordinated
Vulnerability type / classification: Privilege Escalation
Attack type: Remote
Attack vector: Network, requiring highest administrative privileges
Summary
In environments with multiple tenants a user with very high privileges in one tenant could invite a user to another tenant and thereby obtain privileges in that tenant.
Description
The vulnerability affects the functionality to invite the initial user to a tenant. A user with very high privileges in one tenant may be able to invite a user to another tenant and thereby gain privileges across tenants.
The attack is now prevented by ensuring that actions requiring very high privileges, such as Supervisor permissions, can only be performed from the “root” tenant.
For DriveLock Cloud the “root” tenant is not available to regular users. Also the privilege escalation to gain the required rights (see Security Bulletin #26-007) has already been patched for the current cloud release (25.2).
Affected versions
-
DriveLock 24.2 — vulnerable
-
DriveLock 25.1 — vulnerable
-
DriveLock 25.2 — vulnerable
Mitigation
Update to DriveLock 26.1 once available.
Until the update is applied, ensure that Supervisor permissions are assigned only to trusted administrative users who require this level of access.
Fixed in
-
DriveLock 26.1
Credits
This vulnerability was discovered by stuxxn working with CCC
How to update your environment
To ensure continued protection, update to the fixed version listed above. Additionally, we always recommend using the latest available DriveLock release to benefit from ongoing improvements and security enhancements.