CVE-2026-42185 — People is an application to handle users and teams, and

title: CVE-2026-42185: Unauthenticated User Promotion to Owner Role
id: scw-2026-05-08-ai-1
status: experimental
level: critical
description: |
  Detects the specific API endpoint and HTTP method used to exploit CVE-2026-42185. An attacker with Administrator role on a mail domain can send a crafted invitation request to promote any existing user to the Owner role without acceptance. This rule specifically targets the invitation API endpoint used in the exploit.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42185/
tags:
  - attack.privilege_escalation
  - attack.t1078.004
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/v1/invitations'
      cs-method:
          - 'POST'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse