CVE-2019-17201

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service (Audckq32.exe) using a .NET named pipe. If the underlying service responds that a user is permitted access to the elevation feature, the client then reinitiates communication with the underlying service and requests elevation. This elevation request has no local checks in the service, and depends on client-side validation in the AdminByRequest.exe interface, i.e., it is a vulnerable exposed functionality in the service. By communicating directly with the underlying service, any user can request elevation and obtain Administrator privilege regardless of group policies or permissions.

• https://improsec.com/en/responsible-disclosureThird Party Advisory
• https://www.adminbyrequest.com/en/releasenotes
• https://improsec.com/en/responsible-disclosureThird Party Advisory
• https://www.adminbyrequest.com/en/releasenotes

Published

Jan 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17191The Signal Private Messenger application before 4.47.7 for A…7.5
• CVE-2019-17192The WebRTC component in the Signal Private Messenger applica…9.8
• CVE-2019-17195Connect2id Nimbus JOSE+JWT before v7.9 can throw various unc…9.8
• CVE-2019-17197OpenEMR through 5.0.2 has SQL Injection in the Lifestyle dem…9.8
• CVE-2019-17199www/getfile.php in WPO WebPageTest 19.04 on Windows allows D…7.5
• CVE-2019-1720A vulnerability in the XML API of Cisco Expressway Series an…6.8
• CVE-2019-17202FastTrack Admin By Request 6.1.0.0 supports group policies t…7.8
• CVE-2019-17203TeamPass 2.1.27.36 allows Stored XSS at the Search page by s…5.4
• CVE-2019-17204TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Kn…5.4
• CVE-2019-17205TeamPass 2.1.27.36 allows Stored XSS by placing a payload in…6.1
• CVE-2019-17206Uncontrolled deserialization of a pickled object in models.p…9.8
• CVE-2019-17207A reflected XSS vulnerability was found in includes/admin/ta…5.4