CVE-2026-72840: OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write

Published Aug 13, 2026

Updated

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

Affected Software

1 affected component

OpenWrt OpenWrt LuCI

Event History

Aug 13, 2026

CVE Published

via MITRE·09:54 PM

Data Sourced

via MITRE·09:54 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72840?

The severity of CVE-2026-72840 is high with a score of 8.8.

How do I fix CVE-2026-72840?

To fix CVE-2026-72840, restrict the ACL permissions for luci-mod-system-mounts to prevent unauthorized write access to /etc/crontabs/root.

What systems are affected by CVE-2026-72840?

CVE-2026-72840 affects OpenWrt LuCI, specifically the luci-mod-system-mounts component.

What type of vulnerability is CVE-2026-72840?

CVE-2026-72840 is a root command execution vulnerability due to an overly permissive ACL.

Who can exploit CVE-2026-72840?

Authenticated users with the mount-configuration ACL group can exploit CVE-2026-72840 by appending arbitrary cron entries.