{"id":"CVE-2026-126780","kind":"vulnerability","aliases":["CVE-2026-126780"],"related":[],"title":"Webmin: delegated admins can grant themselves root-level command shell access","description":"Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.","summary":"Webmin through 2.670 lets a delegated administrator submit an arbitrary module list when saving a group, granting modules such as Command Shell that they should not have. An attacker with Webmin Users module access can add themselves to such a group and run commands as root.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","self-hosted","webmin"],"not_affected_if":["auth-required","single-admin"],"how_to_check":"- Check the installed Webmin version, for example with `webmin --version` or the version shown in the Webmin dashboard, and compare it with the fixed release in the product data.\n- Review which accounts hold access to the Webmin Users module and whether any delegated administrators can create or edit groups.\n- Look for groups in the Webmin Users module that include Command Shell or other powerful modules.","fix":"- Webmin: move to a version later than `2.670` (the fixed release is named in the product data and patch links, not confirmed here).","status":"open","published_at":"2026-11-11T19:17:38+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","triaged_at":"2026-11-11T19:29:53+00:00","updated_at":"2026-11-11T19:29:53+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T19:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Webmin: move to a version later than `2.670` (the fixed release is named in the product data and patch links, not confirmed here).","reach":"network","title":"Webmin: delegated admins can grant themselves root-level command shell access","impact":"high","summary":"Webmin through 2.670 lets a delegated administrator submit an arbitrary module list when saving a group, granting modules such as Command Shell that they should not have. An attacker with Webmin Users module access can add themselves to such a group and run commands as root.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["webmin","self-hosted","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs commands as root on the server","analyst_note":"Confirm the fixed Webmin version from the linked GitHub patch commits and the VulnCheck advisory; the sources do not state the exact fixed release.","how_to_check":"- Check the installed Webmin version, for example with `webmin --version` or the version shown in the Webmin dashboard, and compare it with the fixed release in the product data.\n- Review which accounts hold access to the Webmin Users module and whether any delegated administrators can create or edit groups.\n- Look for groups in the Webmin Users module that include Command Shell or other powerful modules.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","single-admin"],"who_is_affected":"Only Webmin installations where some users have access to the Webmin Users module can be exploited, since the attacker needs that delegated access first. Servers where only the root account administers Webmin are not exposed through this path. Teams running Webmin as a shared admin panel should treat delegated administrators as privileged.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4624,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126780':15A,18A '-2026':14A,17A '2.670':27B,73C 'access':12A,58B,103C 'acl/save_group.cgi':80C 'add':60B 'admin':3A 'administr':31B,84C 'allow':82C 'arbitrari':34B,91C 'assign':115C 'attack':53B,98C 'command':10A,45B,68B,112C,120C 'contain':74C 'creat':105C 'cve':13A,16A 'deleg':2A,30B,83C 'edit':107C 'escal':77C 'execut':119C 'grant':5A,41B,86C 'group':40B,65B,108C 'hold':109C 'host':23B 'infrastructur':19B 'let':28B 'level':9A 'like':111C 'linux':20B 'list':36B,93C 'membership':117C 'mod':96C 'modul':35B,42B,57B,88C,92C,102C,110C 'paramet':97C 'privileg':76C 'root':8A,70B,122C 'root-level':7A 'run':67B 'save':38B 'self':22B 'self-host':21B 'shell':11A,46B,113C 'submit':32B,90C 'unauthor':87C 'user':56B,101C 'vulner':78C 'webmin':1A,24B,25B,55B,71C,100C","nicknames":[],"mitigations":[],"who_affected":"Only Webmin installations where some users have access to the Webmin Users module can be exploited, since the attacker needs that delegated access first. Servers where only the root account administers Webmin are not exposed through this path. Teams running Webmin as a shared admin panel should treat delegated administrators as privileged.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","linux","selfhosted","webmin"],"campaign_type":null,"search_a":"'-126780':15A,18A '-2026':14A,17A 'access':12A 'admin':3A 'command':10A 'cve':13A,16A 'deleg':2A 'grant':5A 'level':9A 'root':8A 'root-level':7A 'shell':11A 'webmin':1A","search_b":"'2.670':27B 'access':58B 'add':60B 'administr':31B 'arbitrari':34B 'attack':53B 'command':45B,68B 'deleg':30B 'grant':41B 'group':40B,65B 'host':23B 'infrastructur':19B 'let':28B 'linux':20B 'list':36B 'modul':35B,42B,57B 'root':70B 'run':67B 'save':38B 'self':22B 'self-host':21B 'shell':46B 'submit':32B 'user':56B 'webmin':24B,25B,55B","search_c":"'2.670':73C 'access':103C 'acl/save_group.cgi':80C 'administr':84C 'allow':82C 'arbitrari':91C 'assign':115C 'attack':98C 'command':112C,120C 'contain':74C 'creat':105C 'deleg':83C 'edit':107C 'escal':77C 'execut':119C 'grant':86C 'group':108C 'hold':109C 'like':111C 'list':93C 'membership':117C 'mod':96C 'modul':88C,92C,102C,110C 'paramet':97C 'privileg':76C 'root':122C 'shell':113C 'submit':90C 'unauthor':87C 'user':101C 'vulner':78C 'webmin':71C,100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126780","severity":null,"published_at":"2026-11-11T19:17:38+00:00","modified_at":"2026-11-11T19:17:39+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","fetched_at":"2026-11-11T19:28:47+00:00","note":null}],"documents":[{"id":128127,"url":"https://github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128128,"url":"https://github.com/webmin/webmin/commit/c861e308f4ee4cff1795ccc7621fc75623e1bb90","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128129,"url":"https://www.vulncheck.com/advisories/webmin-through-2.670-privilege-escalation-via-acl-save-group-cgi","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}