CVE-2026-126780

EUVD-2026-123774
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
webminwebmin
𝑥
≤ 2.670
CNA
Common Weakness Enumeration
References
https://github.com/webmin/webmin/blob/2.670/acl/save_group.cgi#L83
https://github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098a
https://github.com/webmin/webmin/commit/c861e308f4ee4cff1795ccc7621fc75623e1bb90
https://www.vulncheck.com/advisories/webmin-through-2.670-privilege-escalation-via-acl-save-group-cgi