CVE-2026-50881: Incorrect access control in the impworks Bonsai v6

Synopsis

Incorrect access control in impworks Bonsai v6.0 allows an authenticated attacker with Editor-level privileges to escalate to Administrator and make unauthorized account, password, and configuration changes. The vulnerability is reachable over the network and requires no interaction from any other user or admin. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Bonsai service over the network; there is no requirement for local or physical access.

• AuthenticationRequired

  Any account holding Editor privileges is sufficient to attempt the escalation; a higher-privileged or admin credential is not needed to begin the attack.

• Victim interactionNot required

  No other user or administrator needs to take any action for exploitation to succeed.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental factors must be satisfied.

Blast Radius

• A successful attacker elevates their own account from Editor to Administrator within the application.
• With Administrator access, the attacker reads and modifies stored account credentials and user records.
• The attacker can change application configuration, potentially redirecting behavior or embedding backdoor settings.
• Password changes for other accounts lock out legitimate administrators and users from the application.