CVE-2024-57726: SimpleHelp Missing Authorization -- Privilege Escalation via API Keys

Background

SimpleHelp is a self-hosted remote support platform used by managed service providers and IT organisations to provide remote access to client endpoints. The platform operates a role-based access model where technicians are granted limited permissions, while administrators control system-wide configuration, user management, and integrations.

CVE-2024-57726 undermines this access control model by allowing any authenticated technician to create API keys bearing permissions that exceed their own access level. Combined with CVE-2024-57728 (zip slip path traversal), this vulnerability forms a two-step exploit chain: a low-privilege technician account escalates to admin via forged API keys, then uses admin access to write arbitrary files to the server via malicious archive upload. CISA added this vulnerability to the KEV catalogue on 2026-04-24 with Known Ransomware exploitation confirmed.

Technical Mechanism

The vulnerability is a missing authorisation check in the API key management functionality. Proper authorisation controls require the server to verify that the requesting user has the appropriate privilege level before allowing an operation. In this case, the server fails to enforce the constraint that a technician cannot create an API key with permissions exceeding their own.

The attack flow is as follows:

1. An attacker obtains a low-privilege technician account on the SimpleHelp server — this may be through credential theft, phishing, default credentials, or purchase from an access broker
2. The technician account accesses the API key creation endpoint (accessible to all authenticated users)
3. The API request is crafted to specify administrative permission scopes for the new API key, rather than the restricted scopes appropriate to the technician’s role
4. The server creates the API key with the requested elevated permissions without verifying that the requester is authorised to grant those permissions
5. The attacker uses the elevated API key to perform administrative actions: creating new admin accounts, accessing all remote sessions, exporting customer data, or proceeding to CVE-2024-57728 file write exploitation

The technical root cause is a broken object-level authorisation (BOLA/IDOR) pattern applied to the API key permissions field — the server checks that the user is authenticated but not that they are authorised to request the specified permission level.

Real-World Exploitation Evidence

CVE-2024-57726 was added to CISA KEV on 2026-04-24 alongside CVE-2024-57728. The two vulnerabilities are frequently exploited together in MSP-targeting ransomware campaigns:

• Ransomware operators targeting MSPs first compromise a technician-level account (often through credential stuffing or phishing), then use CVE-2024-57726 to escalate to admin, enabling access to all managed customer remote sessions
• The chained exploitation (CVE-2024-57726 → CVE-2024-57728) provides a complete path from low-privilege technician to arbitrary code execution on the SimpleHelp server
• MSP-targeting has been a consistent ransomware strategy, as a single SimpleHelp server compromise can yield simultaneous access to dozens or hundreds of customer environments

Security researchers highlighted that in some SimpleHelp deployments, technician accounts are provisioned with weak or default credentials, dramatically lowering the prerequisite for exploitation.

Impact Assessment

The direct target is any authenticated technician account on a SimpleHelp server; an attacker who holds even a low-privilege technician credential can silently create API keys bearing full administrative permissions. With those keys, the attacker controls the SimpleHelp instance: creating new accounts, accessing all active remote sessions, exporting customer data, and reading stored credentials. The CVSS 7.8 score reflects the authenticated prerequisite, but the practical bar is low given the frequency of credential compromise through phishing and credential stuffing against remote support staff.

The broader impact is amplified by the MSP deployment model. A single SimpleHelp server typically manages hundreds or thousands of customer endpoints; admin-level access to the server yields simultaneous access to all of them. This multiplier effect is precisely why MSP tools are a priority target for ransomware operators: one exploitation event can convert into dozens of downstream customer compromises. When chained with CVE-2024-57728, the attack escalates from privilege escalation to arbitrary file write and code execution on the server, enabling persistent backdoors that survive SimpleHelp patching. Organisations that provide managed services should treat this as a supply-chain-level exposure.

Affected Versions

Consult the SimpleHelp official security advisory for version-specific patch information.

Remediation Steps

1. Update SimpleHelp to the latest patched version immediately
2. Audit all existing API keys in the SimpleHelp admin interface and revoke any that have elevated permissions beyond what is expected for the creating account
3. Review all technician accounts for signs of suspicious activity: unexpected logins, API key creation events, or configuration changes
4. Enforce strong password requirements and multi-factor authentication for all SimpleHelp technician and admin accounts
5. Restrict admin interface access to trusted IP ranges
6. Implement network segmentation to limit which systems the SimpleHelp server can reach outbound
7. Review audit logs for API key creation events since the last known-clean state
8. Address CVE-2024-57728 in the same patching cycle to close the complete exploit chain

Detection Guidance

SimpleHelp admin audit log — review for:

• API key creation events by technician-level accounts
• API keys with administrative permission scopes created by non-admin users
• Unusual admin activity following API key creation (config changes, user account creation)

Authentication anomalies:

• Logins from unexpected geographic locations or IP addresses for technician accounts
• Logins outside normal business hours for specific technician accounts
• Multiple failed login attempts followed by successful login (credential stuffing indicator)

SIEM query example (Splunk):

index=simplehelp_logs action="api_key_created"
| join user [search index=simplehelp_logs action="login" | stats latest(role) as user_role by user]
| where user_role!="admin" AND isnotnull(api_key_permissions)
| stats count by user, user_role, api_key_permissions, src_ip

Network indicators:

• Unexpected administrative API calls following technician logins
• API key authentication for operations inconsistent with the associated technician’s normal workflow

Timeline

References

• NVD — CVE-2024-57726
• CISA KEV — CVE-2024-57726
• MITRE CVE — CVE-2024-57726