CVE-2026-27012: OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 0.7%, percentile 52: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 52% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes devcode-it/openstamanager (Composer (PHP)) <= 2.9.8, no fixed version listed. Check your lockfile, including transitive dependencies.

What it is

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user's group (idgruppo) by directly calling modules/utenti/actions.php. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.

From the GitHub advisory

Summary A privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user's group (idgruppo) by directly calling modules/utenti/actions.php. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.

Details modules/utenti/actions.php is reachable directly via http:// :8080/modules/utenti/actions.php and processes privileged information without requiring any authentication or authorization checks on fields like idgruppo. As a result, an attacker can submit a crafted POST request that updates the targets record and assigns it to the administrator group.

The file explicitly sets:

core.php then invokes:

Thus, disabling any authentication and permission enforcement. As a result, this file processes operations based on the op parameter in the POST request, not only updateuser. Sensitive fields like idgruppo and others can be updated without verifying anything.

Weakness type: CWE-306.

Product: devcode-it/openstamanager (Composer (PHP)) · Assigned by: GitHub_M · Published: 2026-03-03

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.69% probability of exploitation activity in the next 30 days; percentile 52.

Timeline

• 2026-03-03 — CVE record published by GitHub_M
• 2026-03-03 — GitHub-reviewed advisory GHSA-247v-7cw6-q57v published (critical)
• 2026-03-04 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-247v-7cw6-q57v github.com
2. CVE.org record CVE-2026-27012 cve.org
3. NVD entry CVE-2026-27012 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com

Critical Composer (PHP) advisories · Today’s Security Digest