# CVE-2026-26725: edu Business Solutions Print Shop Pro WebDesk privilege escalation via AccessID

Source: https://junglewise.ai/threats/cve-2026-26725-edu-business-solutions-print-shop-pro-webdesk-privilege  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-20. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-26725 · Severity: critical · CVSS 9.8 · Published 2026-02-20

A vulnerability in Print Shop Pro WebDesk, a software suite used to manage print shop operations and web-to-print services, allows unauthorized users to grant themselves administrative privileges. By manipulating a specific setting during account registration or profile updates, an attacker can gain full control over the application. This could lead to the exposure of sensitive customer data, disruption of printing services, and unauthorized access to management functions.

Technologies: [Edubusinesssolutions Print Shop Pro Webdesk](https://junglewise.ai/threats/technologies/print-shop-pro-webdesk). Vendors: [Edubusinesssolutions](https://junglewise.ai/threats/vendors/edubusinesssolutions).

## Quick answers

**Is CVE-2026-26725 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26725 being exploited in the wild.

**How severe is CVE-2026-26725?** Critical severity, with a CVSS score of 9.8, published 20 February 2026.

**Which products and versions are affected?** edu Business Solutions Print Shop Pro WebDesk 18.34 (fixed in 19.76).

**Is there a fix for CVE-2026-26725?** A patch was published on 2026-05-14: Updated description confirms fix in version 19.76 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26725 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-26725?** Check whether you run Edubusinesssolutions Print Shop Pro Webdesk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in edu Business Solutions Print Shop Pro WebDesk v.18.34 due to improper privilege management (CWE-269) and a lack of server-side validation on the 'AccessID' parameter. An attacker can self-register an account and then submit a crafted profile update request to the '/PSP/app/web/reg/reg_process.asp' endpoint, setting the 'AccessID' parameter to '1'. Because the application trusts this client-supplied value without verifying the user's current authorization level, the attacker's account is promoted to Super Admin status. This allows for full application takeover and access to administrative functionality at '/PSP/appNet/ManagerHome.aspx'. The issue is resolved in version 19.76.

## Affected products

- edu Business Solutions Print Shop Pro WebDesk 18.34 (fixed in 19.76)

## Timeline

- 2026-02-20: disclosed: Initial disclosure and CVE assignment
- 2026-02-20: advisory: NVD publication date
- 2026-05-14: patched: Updated description confirms fix in version 19.76

## References

- [https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2026-26725](https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2026-26725)

## Related threats

- [Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the…](https://junglewise.ai/threats/cve-2025-61550-cross-site-scripting-xss-is-present-on-the-ctl00-content01)
- [Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu…](https://junglewise.ai/threats/cve-2025-61549-cross-site-scripting-xss-is-present-on-the-loginid-parameter-on)
- [SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice…](https://junglewise.ai/threats/cve-2025-61548-sql-injection-is-present-on-the-hfinventorydistformid-parameter)
- [Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version…](https://junglewise.ai/threats/cve-2025-61547-cross-site-request-forgery-csrf-is-present-on-all-functions-in)
- [There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro…](https://junglewise.ai/threats/cve-2025-61546-there-is-an-issue-on-the-psp-appnet-store-cartv12-aspx)