CVE-2026-25958: Cube Core is vulnerable to privilege escalation via a specially crafted request

Impact

It is possible to make a specially crafted request with a valid API token that leads to privilege escalation.

Affected Versions:

≥= 0.27.19

Mitigation:

Upgrade to a patched version:

• 1.5.13 and later (regular release)
• 1.4.2 (active LTS release)
• 1.0.14 (end-of-life LTS release)

References

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.