CVE-2026-126780 is a high-severity (CVSS 7.2) Improper Privilege Management vulnerability in webmin webmin. Versions up to 2.670 are affected; the records list no fixed version yet, so check the vendor advisory below.
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module…
Description
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.
Affected Products
webminwebminDetection & mitigation playbook
Vendor / applianceDetect
Inventory every webmin webmin deployment and check each version against the affected-products list above.
Remediation status
The records we use list no fixed version for CVE-2026-126780 (versions up to 2.670 are affected). Check the webmin webmin advisory for a patched release, and apply the workarounds below until you can upgrade.
Mitigate without a patch
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-126780 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.