Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-59255

BloodHound Missing Authorization on Custom Node Management API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SpecterOps BloodHound

Default version status: unaffected

  • 0 to ≤ 9.4.0affected
  • 8f790351349fd87bcb04377aba84cba6495825b3unaffected
pkg:github/SpecterOps/BloodHound

References