---
id: "CVE-2026-126780"
page: "https://infrastack.ai/live/CVE-2026-126780"
kind: "vulnerability"
aliases: ["CVE-2026-126780"]
title: "Webmin: delegated admins can grant themselves root-level command shell access"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux", "self-hosted", "webmin"]
not_affected_if: ["auth-required", "single-admin"]
published_at: "2026-11-11T19:17:38+00:00"
first_seen_at: "2026-11-11T19:28:47+00:00"
updated_at: "2026-11-11T19:29:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126780", "first_seen_at": "2026-11-11T19:28:47+00:00"}]
exploit_sources: []
---

# Webmin: delegated admins can grant themselves root-level command shell access

Link for people: https://infrastack.ai/live/CVE-2026-126780 (this .md is for agents)

Webmin through 2.670 lets a delegated administrator submit an arbitrary module list when saving a group, granting modules such as Command Shell that they should not have. An attacker with Webmin Users module access can add themselves to such a group and run commands as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webmin version, for example with `webmin --version` or the version shown in the Webmin dashboard, and compare it with the fixed release in the product data.
- Review which accounts hold access to the Webmin Users module and whether any delegated administrators can create or edit groups.
- Look for groups in the Webmin Users module that include Command Shell or other powerful modules.

## Fix

- Webmin: move to a version later than `2.670` (the fixed release is named in the product data and patch links, not confirmed here).

## Timeline

- 2026-11-11T19:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126780

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/webmin-through-2.670-privilege-escalation-via-acl-save-group-cgi
- [fix] Patch: github.com https://github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098a
- [fix] Patch: github.com https://github.com/webmin/webmin/commit/c861e308f4ee4cff1795ccc7621fc75623e1bb90

## From the sources

Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_