ZeroDay Findings
Sign inSign up

Findings

CVE-2026-42185

People is an application to handle users and teams, and distribute permissions across La Suite.

Published May 8, 2026 · updated Jun 17, 2026

People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 8, 2026 · NIST NVD

    Detected

    People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownershi

  2. Jun 17, 2026 · NIST NVD

    Updated

    People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownershi

Sources

  • CVE.orgVulnerability recordCVE-2026-42185

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-42185

    People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current do

    nvd.nist.gov

References