{"id":"CVE-2026-67548","summary":"taOS: Non-Admin Users Can Access System Settings and Update Actions","details":"taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose is_admin flag is explicitly False—can read the full system configuration, overwrite it, modify platform settings, trigger a git pull + dependency reinstall + service restart, and switch the tracked update branch. Successful exploitation of the write endpoints causes immediate configuration corruption or a denial of service for all users on the instance from a low-privileged account. This issue has been patched in version 1.0.0-beta.25.","aliases":["GHSA-47g9-fwwp-hrfp"],"modified":"2026-11-12T10:45:32.324037078Z","published":"2026-11-11T21:46:13.292Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67548.json","unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"1.0.0-beta.25"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"fixed":"1.0.0-beta.25"},{"fixed":"1.0.0-beta.25"}]}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67548.json"},{"type":"FIX","url":"https://github.com/jaylfc/taOS/commit/6e65dd7ddd4b973e326d7ccb0ec74e8eef65374b"},{"type":"WEB","url":"https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.25"},{"type":"ADVISORY","url":"https://github.com/jaylfc/taOS/security/advisories/GHSA-47g9-fwwp-hrfp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67548"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jaylfc/taos","events":[{"introduced":"0"},{"fixed":"6e65dd7ddd4b973e326d7ccb0ec74e8eef65374b"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"6e65dd7ddd4b973e326d7ccb0ec74e8eef65374b"}]}]}}],"versions":["v1.0.0-beta.2","v1.0.0-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67548.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"}]}