https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-29196.htmlhttps://patchthecve.com/cve/CVE-2026-29196.htmlWed, 17 Jun 2026 10:29:45 +0000MEDIUM 4.3: Netmaker makes networks with WireGuard. Prior to version 1.5.0, a user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API ehttps://patchthecve.com/cve/CVE-2026-29195.htmlhttps://patchthecve.com/cve/CVE-2026-29195.htmlWed, 17 Jun 2026 10:29:45 +0000MEDIUM 6.5: Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to anohttps://patchthecve.com/cve/CVE-2026-29194.htmlhttps://patchthecve.com/cve/CVE-2026-29194.htmlWed, 17 Jun 2026 10:29:45 +0000HIGH 8.1: Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorization checks without verifying that the host is