CVE-2026-49819

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.

• CWE-78
• CWE-269
• CWE-306
• CWE-862

• https://github.com/seriousm4x/UpSnap/releases/tag/5.4.0
• https://github.com/seriousm4x/UpSnap/security/advisories/GHSA-w4jr-728f-5jhq
• https://github.com/seriousm4x/UpSnap/security/advisories/GHSA-w4jr-728f-5jhq

Published

Aug 13, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49813Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…6.7
• CVE-2026-49814Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-49815Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-49816Dell Command Update (DCU), versions prior to 5.7.1, contain …7.8
• CVE-2026-49817Dell Command Update (DCU), versions prior to 5.7.1, contain …7.8
• CVE-2026-49818The Apache Airflow Samba provider's `GCSToSambaOperator` joi…6.5
• CVE-2026-4982A user with permission "update world" in any Venueless world…7.3
• CVE-2026-49820Probo is a self-hostable governance, risk, and compliance (G…4.7
• CVE-2026-49821Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49822Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49823Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49824Fission is an open-source, Kubernetes-native serverless fram…8.5