{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "4.4.1"
              },
              {
                "fixed": "5.4.0"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "47b81553befa785b73ddc8aff2c6774975791ff2"
            },
            {
              "fixed": "92f9e295d5f761d874a6701245b2e38dc42cb85a"
            }
          ],
          "repo": "https://github.com/seriousm4x/upsnap",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-w4jr-728f-5jhq"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-269",
      "CWE-306",
      "CWE-78",
      "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49819.json"
  },
  "details": "UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers \u003e 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, \"/bin/sh\", \"-c\", wake_cmd)`). Version 5.4.0 fixes the issue.",
  "id": "CVE-2026-49819",
  "modified": "2026-08-15T11:31:07.267830922Z",
  "published": "2026-08-12T23:13:46.298Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/seriousm4x/UpSnap/releases/tag/5.4.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49819.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/seriousm4x/UpSnap/security/advisories/GHSA-w4jr-728f-5jhq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49819"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd"
}