AIKIDO-2026-10286

TL;DR

Affected versions of this package are vulnerable to a privilege escalation issue caused by a race condition in the user role validation logic. During role updates, concurrent requests could temporarily rely on stale role data, allowing permission checks to succeed even though the user’s role was being downgraded. Under specific timing conditions—such as when an administrator was being demoted while simultaneously performing account ownership operations—this race window could allow actions requiring elevated privileges to proceed. In coordinated scenarios involving multiple administrator accounts, this could potentially result in unauthorized role changes or ownership transfers. The issue is fixed by ensuring role validation is performed against consistent and up-to-date role data during role updates, eliminating the race condition and preventing privilege escalation.