PSA-2026-00098: Proxmox Datacenter Manager: Incomplete privilege checks for syncing users in external realms
This Proxmox advisory covers a security issue in Proxmox Datacenter Manager.
Key facts
- Fixed in
- proxmox-datacenter-manager 1.1.9
- Advisory id
- PSA-2026-00098
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Due to a conflicting interpretation of the used privilege-bits it was possible for a user having Access. Audit privileges to trigger a sync of a configured authentication realm.
The issue is addressed by only allowing to sync realms with the permissions needed for other modification on users - Access. Modify.
This issue was found internally. Packages: proxmox-datacenter-manager.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- proxmox-datacenter-manager 1.1.9
Vendor guidance
- Update to the fixed package versions: proxmox-datacenter-manager >= 1.1.9.
More Proxmox advisories
PSA-2026-00099Nov 10, 2026Proxmox: Incomplete validation of UPID when handling "stop task" API requestsPSA-2026-00097Nov 10, 2026Proxmox Datacenter Manager: Authenticated SSRF via ACME Directory URLPSA-2026-00096Nov 10, 2026Proxmox Datacenter Manager: token secrets file writable by unprivileged API daemon userPSA-2026-00095Nov 10, 2026Proxmox Virtual Environment: Broken privilege checks when modifying container NICsPSA-2026-00094Nov 10, 2026Proxmox Virtual Environment: OCI extraction path escapePSA-2026-00093Nov 10, 2026Proxmox Virtual Environment: FRR config injection issues
Get an email when Proxmox publishes the next one.
See Proxmox's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Datacenter Manager from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
