Quick answers
- Is CVE-2026-126780 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126780 being exploited in the wild.
- How severe is CVE-2026-126780?
- High severity, with a CVSS score of 7.2, published 11 November 2026.
- Which products and versions are affected?
- Webmin through 2.670.
- Is there a fix for CVE-2026-126780?
- Yes: fixed in Webmin 2.671. Until then: Restrict access to the Webmin Users module and group management features to trusted administrators only. Audit existing user and group ACL configurations to ensure no unauthorized module assignments exist. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-126780 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-126780?
- Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Webmin 2.671
Restrict access to the Webmin Users module and group management features to trusted administrators only. Audit existing user and group ACL configurations to ensure no unauthorized module assignments exist.
Technical details
The vulnerability exists in acl/save_group.cgi where the module list validation occurs after parent group membership changes, rather than before. A delegated administrator (with mode 1 or 2 access) can submit arbitrary modules in the mod parameter that they do not have permission to grant. The validation only checks against their grantable modules, but the order of operations allows privilege escalation when assigning group membership. An attacker gains the ability to assign themselves to groups with restricted modules such as Command Shell, enabling command execution as root.
Affected products
- Webmin Webmin through 2.670
Timeline
- 2026-11-11: disclosed