CVE-2026-65199

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In route_mapper/account.lua, get_user_privilege returns the complete nine-privilege set for a special_users group that includes the SNMPv1_v2c pseudo-user.