Privilege Escalation Vulnerability in Webmin by Virtualmin

CVE-2026-126780

What is CVE-2026-126780?

Webmin version 2.670 contains a vulnerability in the acl/save_group.cgi script that allows delegated administrators to manipulate access controls. By submitting arbitrary module lists, an attacker exploiting this flaw can grant themselves unauthorized access to critical modules, including the Command Shell, enabling them to execute commands with root privileges. This presents a serious security risk for systems running Webmin, as it can lead to unauthorized actions and potential system compromise.

References