CVE-2020-36969 HIGH

CVE-2020-36969: M/Monit 3.7.4 - Privilege Escalation

Vendor Tildeslash Ltd.
Product M/Monit
Weakness CWE-863 · Incorrect authorization
Published January 28, 2026
Last update March 5, 2026

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Attackers can send a POST request to the /api/1/admin/users/update endpoint with a crafted payload to grant administrative access to a standard user account.

Key dates

02Disclosure timeline

January 28, 2026 CVE published
March 5, 2026 Record updated