CVE-2026-126780: Webmin through 2.670 Privilege Escalation via acl/save_group.cgi
Webmin through 2.670 contains a privilege escalation vulnerability in acl/savegroup.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Webmin installations through version 2.670 are exposed when a delegated administrator has access to the Webmin Users module. The attacker must already hold authenticated, high-privilege Webmin access; the provided vector does not describe unauthenticated exploitation.
What can an attacker achieve?
A delegated administrator can submit arbitrary module names in the mod parameter while creating or editing a group. They can add modules such as Command Shell, assign themselves to that group, and execute commands as root.
How can I determine whether this issue may have been exploited?
Review Webmin group creation and modification activity for unexpected module lists, particularly groups granted Command Shell or other unauthorized modules. Also check whether delegated administrator accounts were added to such groups.