{"action":"Upgrade poweradmin/poweradmin to 4.2.5 or later.","affected":[{"fixed":"4.2.5","introduced":"4.0.0"},{"fixed":"4.3.4","introduced":"4.3.0"}],"component":"poweradmin/poweradmin","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["4.2.5","4.3.4"],"ghsa_id":"GHSA-h4hf-v6w5-897x","id":"tcs_01M5KF3A71F1ZS5S200BGM1JTC","modified_at":"2026-07-24T22:00:28.169028689Z","published_at":"2026-07-24T21:54:55Z","references":["https://osv.dev/vulnerability/GHSA-h4hf-v6w5-897x","https://github.com/poweradmin/poweradmin/security/advisories/GHSA-h4hf-v6w5-897x","https://github.com/poweradmin/poweradmin/commit/36e9081a5c83cb962dc6275b7adcd6cb463f1028","https://github.com/poweradmin/poweradmin/commit/9bdda77bc103f283a0babcaf3355f3f95b360122","https://github.com/poweradmin/poweradmin/commit/b90fd83e67e6d7b6ad6c9be3a1c0d2f45bd73b6c","https://github.com/poweradmin/poweradmin/commit/ffb95d5201cad5cb38e3eabc4f8103cac2ca18e2","https://github.com/poweradmin/poweradmin","https://github.com/poweradmin/poweradmin/releases/tag/v4.2.5","https://github.com/poweradmin/poweradmin/releases/tag/v4.3.4"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-h4hf-v6w5-897x","url":"https://osv.dev/vulnerability/GHSA-h4hf-v6w5-897x"}],"summary":"Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account"}