# CVE-2026-126780: Webmin privilege escalation in ACL group module assignment

Source: https://junglewise.ai/threats/cve-2026-126780-webmin-through-2-670-contains-a-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126780 · Severity: high · CVSS 7.2 · Published 2026-11-11

Webmin is a web-based system administration tool that allows remote management of Unix/Linux servers. A vulnerability in the group management feature allows delegated administrators to grant themselves access to restricted modules like Command Shell, leading to unauthorized command execution as root. An attacker with Webmin Users module access can modify group permissions to gain complete control over the system.

Technologies: [Webmin](https://junglewise.ai/threats/technologies/webmin). Vendors: [Webmin](https://junglewise.ai/threats/vendors/webmin).

## Quick answers

**Is CVE-2026-126780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126780 being exploited in the wild.

**How severe is CVE-2026-126780?** High severity, with a CVSS score of 7.2, published 11 November 2026.

**Which products and versions are affected?** Webmin through 2.670.

**Is there a fix for CVE-2026-126780?** Yes: fixed in Webmin 2.671. Until then: Restrict access to the Webmin Users module and group management features to trusted administrators only. Audit existing user and group ACL configurations to ensure no unauthorized module assignments exist. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126780 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126780?** Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Webmin 2.671

Restrict access to the Webmin Users module and group management features to trusted administrators only. Audit existing user and group ACL configurations to ensure no unauthorized module assignments exist.

## Technical details

The vulnerability exists in acl/save_group.cgi where the module list validation occurs after parent group membership changes, rather than before. A delegated administrator (with mode 1 or 2 access) can submit arbitrary modules in the mod parameter that they do not have permission to grant. The validation only checks against their grantable modules, but the order of operations allows privilege escalation when assigning group membership. An attacker gains the ability to assign themselves to groups with restricted modules such as Command Shell, enabling command execution as root.

## Affected products

- Webmin Webmin through 2.670

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/webmin/webmin/blob/2.670/acl/save_group.cgi](https://github.com/webmin/webmin/blob/2.670/acl/save_group.cgi)
- [https://github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098a](https://github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098a)

## Related threats

- [Webmin users file injection in cert_issue.cgi](https://junglewise.ai/threats/cve-2026-126781-webmin-through-2-670-contains-a-users-file-injection)
- [Webmin stored cross-site scripting in bind8 DNS records](https://junglewise.ai/threats/cve-2026-125392-webmin-through-2-670-contains-a-stored-cross-site-scripting)
- [Webmin OS command injection in samba/save_euser.cgi](https://junglewise.ai/threats/cve-2026-125391-webmin-through-2-670-contains-an-os-command-injection)
- [Webmin stored cross-site scripting in Shorewall modules](https://junglewise.ai/threats/cve-2026-124552-webmin-through-2-670-contains-a-stored-cross-site-scripting)
- [Webmin SSRF in URL download functionality](https://junglewise.ai/threats/cve-2026-102337-webmin-is-a-web-based-system-administration-tool-for-unix-like)