Webmin: Privilege escalation in acl/save_group.cgi (CVE-2026-126780)
Webmin versions through 2.670 contain a privilege escalation vulnerability that allows authenticated users with access to the Webmin Users module to gain unauthorized module access and execute commands as root.
CVE search metadata
CVE search record: CVE-2026-126780. Severity: high. CVSS: 7.2. KEV: no. Product: Webmin (<= 2.670). Brief: Webmin: Privilege escalation in acl/save_group.cgi (CVE-2026-126780). Brief link: https://feed.craftedsignal.io/briefs/2026-11-webmin-privesc-cve-2026-126780/
Triage facts
Revision 1- Applicability
- Webmin (<= 2.670)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Webmin versions through 2.670 contain a privilege escalation vulnerability within the 'acl/save_group.cgi' script. The flaw permits a delegated administrator with access to the 'Webmin Users' module to manipulate the 'mod' parameter during group editing. By submitting an arbitrary list of modules, an attacker can grant themselves access to privileged modules, including the 'Command Shell' module, which subsequently allows the execution of arbitrary commands with root privileges.
Impact
Successful exploitation allows an authenticated user with limited administrative rights to escalate their privileges to root, resulting in full compromise of the Webmin application and the underlying host system.
Immediate actions
Audit current Webmin deployments and ensure they are patched or protected behind strict network controls.
Threat Hunt
Search for unusual requests to 'acl/save_group.cgi' containing unexpected module identifiers in the 'mod' parameter.
Data: Web server access logs