{"id":"GHSA-87j9-m7x6-hvw2","revision":"7cb3be3668024d2f8bee9b8d57725060","records":[{"revision":"7cb3be3668024d2f8bee9b8d57725060","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-87j9-m7x6-hvw2","aliases":["CVE-2026-33906","GO-2026-4873"],"title":"Ella Core has Privilege Escalation via Database Restore by NetworkManager role","description":"## Summary\n\nThe NetworkManager role was granted backup and restore permission. The restore endpoint accepted any valid SQLite file without verifying its contents.\n\n## Impact\n\nA NetworkManager could replace the production database with a tampered copy to escalate to Admin, gaining access to user management, audit logs, debug endpoints, and operator identity configuration that the role was explicitly denied.\n\n## Fix \n\nBackup and restore permissions have been removed from the NetworkManager role.","state":0,"publishedAt":"2026-03-26T22:14:54+00:00","modifiedAt":"2026-04-02T21:26:14.6588421+00:00","affected":[{"ecosystem":"Go","name":"github.com/ellanetworks/core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.7.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/ellanetworks/core/security/advisories/GHSA-87j9-m7x6-hvw2","https://nvd.nist.gov/vuln/detail/CVE-2026-33906","https://github.com/ellanetworks/core/commit/1e4768288a6519fcb63ec83f851584ecebb8a972","https://github.com/ellanetworks/core","https://github.com/ellanetworks/core/releases/tag/v1.7.0"],"sourceUrl":"https://github.com/advisories/GHSA-87j9-m7x6-hvw2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-87j9-m7x6-hvw2","identifiers":["GHSA-87j9-m7x6-hvw2","CVE-2026-33906","GO-2026-4873"]},"retained":false,"historicalAffected":[]}],"coverage":[]}