Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Webmin up to 2.670 lets low‑privilege users gain root

CVE-2026-126780 · published 2 days ago
Summary

Webmin versions up to 2.670 let users who only have limited admin rights add themselves to powerful groups and run commands as the system’s root user. This happens because the software does not properly check the list of modules a user can assign. Upgrade Webmin to a newer version or apply the vendor’s patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webmin webmin <= 2.670
Original advisory text
Webmin through 2.670 Privilege Escalation via acl/save_group.cgi
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published11 Nov 2026
Updated13 Nov 2026
First seen11 Nov 2026
Sources
CVE-2026-126780 · NVD
CVE-2026-126780 · OSV
CVE-2026-126780 · MITRE
Track software like this
Free during beta