---
id: "CVE-2026-118795"
page: "https://infrastack.ai/live/CVE-2026-118795"
kind: "vulnerability"
aliases: ["CVE-2026-118795"]
title: "Admin roles stored in writable local database fields enable privilege escalation"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "unknown"]
not_affected_if: ["no-db-write-access"]
published_at: "2026-11-09T13:17:05+00:00"
first_seen_at: "2026-11-09T13:26:50+00:00"
updated_at: "2026-11-09T13:27:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118795", "first_seen_at": "2026-11-09T13:26:50+00:00"}]
exploit_sources: []
---

# Admin roles stored in writable local database fields enable privilege escalation

Link for people: https://infrastack.ai/live/CVE-2026-118795 (this .md is for agents)

Administrative roles and module permissions are kept in local database fields that can be changed. An attacker with write access to that database can grant themselves administrator rights.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-09T13:26:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118795

## From the sources

Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_