CVE-2026-45675: First User Admin Toctou
Time-of-Check-Time-of-Use (TOCTOU) race condition detected during first user registration. Checking the active user count before insertion can allow multiple concurrent requests to evaluate as the "first user" and be granted administrative rights. Insert the newly registered user with a default standard role first, then evaluate the user count strictly post-
Pythongreprules fetch cve-2026-45675-first-user-admin-toctou --engine opengrepDescription
Time-of-Check-Time-of-Use (TOCTOU) race condition detected during first user registration. Checking the active user count before insertion can allow multiple concurrent requests to evaluate as the "first user" and be granted administrative rights. Insert the newly registered user with a default standard role first, then evaluate the user count strictly post-
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.