NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner
Date: 2026-04
Affected: go/github.com/netbirdio/netbird
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-362
CVSS: 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N)

## Summary A race condition vulnerability allows authenticated admin-privileged users to escalate to owner privilege. ## Details The vulnerability exists in the `updateUser` function, which is connected to the `/users/{userId}` PUT request. This function then calls the `SaveOrAddUsers` function, which checks the user's permissions on two separate occasions. The first check verifies whether the initiator is an admin or owner and rejects the request if the initiator is not. The second check retrieves the user role details from the database again and saves them in a variable called `initiatorUser`. ### `SaveOrAddUsers` Function **Location:** `netbird/management/server/user.go` — Line 556 ![SaveOrAddUsers function code showing the two separate permission checks](https://github.com/user-attachments/assets/821e79a2-ad3e-45d7-a952-daf5422c1801) Afterwards, the `validateUserUpdate` function is called, which checks if the initiator has permission to update that specific user's role. This validation is lacking, as it assumes the initiator is an admin or owner. In the case that the initiator is a regular user, these conditions do not apply, and the target can be updated to owner even when the initiator holds only a user role. ### `validateUserUpdate` Function **Location:** `netbird/management/server/user.go` — Line 862 ![validateUserUpdate function code showing the insufficient permission validation logic](https://github.com/user-attachments/assets/a7e7f2df-ee4c-45b4-9b4d-c71c


Mitigations:

Architectural layers (MAESTRO):