High severity7.2NVD Advisory· Published Nov 11, 2026· Updated Nov 11, 2026
CVE-2026-126780
CVE-2026-126780
Description
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/webmin/webmin/blob/2.670/acl/save_group.cginvd
- github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098anvd
- github.com/webmin/webmin/commit/c861e308f4ee4cff1795ccc7621fc75623e1bb90nvd
- www.vulncheck.com/advisories/webmin-through-2.670-privilege-escalation-via-acl-save-group-cginvd
News mentions
0No linked articles in our index yet.