{"id":"CVE-2026-118795","kind":"vulnerability","aliases":["CVE-2026-118795"],"related":[],"title":"Admin roles stored in writable local database fields enable privilege escalation","description":"Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.","summary":"Administrative roles and module permissions are kept in local database fields that can be changed. An attacker with write access to that database can grant themselves administrator rights.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","unknown"],"not_affected_if":["no-db-write-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T13:17:05+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:43+00:00","updated_at":"2026-11-09T13:27:43+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-09T13:27:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Admin roles stored in writable local database fields enable privilege escalation","impact":"high","summary":"Administrative roles and module permissions are kept in local database fields that can be changed. An attacker with write access to that database can grant themselves administrator rights.","audience":"businesses","category":"other","nicknames":[],"who_cares":["unknown"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains administrator rights through database field changes","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118795.","how_to_check":"unknown","plain_action":"","product_name":"unknown","needs_analyst":true,"not_affected_if":["no-db-write-access"],"who_is_affected":"Systems where the affected product stores role and module permissions in a local database; the sources do not name the product or versions. Exposure requires that an attacker already has write access to that database, so systems without such access are less at risk. The sources do not say which configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000663,"input_tokens":4487,"output_tokens":428,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118795':14A,17A '-2026':13A,16A 'access':39B,68C 'admin':1A 'administr':20B,46B,48C 'allow':60C 'attack':36B,64C 'chang':34B 'cve':12A,15A 'databas':7A,29B,42B,58C,66C 'enabl':9A 'escal':11A,62C 'field':8A,30B,59C 'grant':44B 'kept':26B 'local':6A,28B,57C 'modul':23B,51C 'mutabl':56C 'permiss':24B,52C 'privileg':10A,61C 'right':47B 'role':2A,21B,49C 'store':3A,54C 'unknown':19B 'writabl':5A 'write':38B,67C","nicknames":[],"mitigations":[],"who_affected":"Systems where the affected product stores role and module permissions in a local database; the sources do not name the product or versions. Exposure requires that an attacker already has write access to that database, so systems without such access are less at risk. The sources do not say which configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","unknown"],"campaign_type":null,"search_a":"'-118795':14A,17A '-2026':13A,16A 'admin':1A 'cve':12A,15A 'databas':7A 'enabl':9A 'escal':11A 'field':8A 'local':6A 'privileg':10A 'role':2A 'store':3A 'writabl':5A","search_b":"'access':39B 'administr':20B,46B 'attack':36B 'chang':34B 'databas':29B,42B 'field':30B 'grant':44B 'kept':26B 'local':28B 'modul':23B 'permiss':24B 'right':47B 'role':21B 'unknown':19B 'write':38B","search_c":"'access':68C 'administr':48C 'allow':60C 'attack':64C 'databas':58C,66C 'escal':62C 'field':59C 'local':57C 'modul':51C 'mutabl':56C 'permiss':52C 'privileg':61C 'role':49C 'store':54C 'write':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118795","severity":null,"published_at":"2026-11-09T13:17:05+00:00","modified_at":"2026-11-09T13:17:05+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}