CVE-2026-126780 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Webmin through 2.670 lets a delegated administrator submit an arbitrary module list when saving a group, granting modules such as Command Shell that they should not have. An attacker with Webmin Users module access can add themselves to such a group and run commands as root.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Webmin installations where some users have access to the Webmin Users module can be exploited, since the attacker needs that delegated access first. Servers where only the root account administers Webmin are not exposed through this path. Teams running Webmin as a shared admin panel should treat delegated administrators as privileged.
Not affected if auth-required, single-admin
Who cares linux, self-hosted, webmin
webmin --version or the version shown in the Webmin dashboard, and compare it with the fixed release in the product data.2.670 (the fixed release is named in the product data and patch links, not confirmed here).Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.