UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126780

Webmin through 2.670 Privilege Escalation via acl/save_group.cgi

Severity
High 8.6
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Improper privilege management (CWE-269)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.

From the CVE Program.

Affected software

SoftwareAffected versions
WebminServers and applications · cna:webmin|webmin
  • Every version up to 2.670

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126780