CVE-2026-72842: OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories and control host-side scripts executed through lxc.hook.start-host, achieving root code execution on the OpenWrt host.