---

Security Bulletin #26-007 - Privilege Escalation via API Token Update

---

---

First published: 2026-04-16

Last updated: 2026-07-06

CVE: Not yet assigned

EUVD: Not yet assigned

CVSS Score: 7.9 - AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected product(s): DriveLock SE

Affected deployment: DriveLock Cloud and DriveLock On-Premise

DriveLock Cloud: Affected. A patch for 25.2 has already been deployed. A correction is included in 26.1.

Disclosure status: Coordinated

Vulnerability type / classification: Improper Authorization / Privilege Escalation

Attack type: Remote

Attack vector: API access with an API key

---

Summary

An attacker with an API key can obtain additional privileges.

Description

The vulnerability affects the update API token functionality. An attacker with an API key may be able to obtain additional permissions due to an incorrect permission check.

The faulty permission check has been corrected.

Affected versions

• DriveLock 24.2 — vulnerable

• DriveLock 25.1 — vulnerable

• DriveLock 25.2 — vulnerable

Mitigation

Update to the patched versions once available. For DriveLock Cloud, a patch for 25.2 has already been deployed.

Fixed in

• DriveLock 24.2

• DriveLock 25.1

• DriveLock 25.2

• DriveLock 26.1

Credits

This vulnerability was discovered by stuxxn working with CCC

How to update your environment

To ensure continued protection, update to one of the fixed versions listed above. Additionally, we always recommend using the latest available DriveLock release to benefit from ongoing improvements and security enhancements.

---